# Grok pattern matching both the logs

**URL:** <https://discuss.elastic.co/t/grok-pattern-matching-both-the-logs/342586>\
**Category:** Logstash\
**Created:** [September 8, 2023, 8:01am UTC](https://discuss.elastic.co/t/grok-pattern-matching-both-the-logs/342586 "2023-09-08T08:01:17Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Neelam\_Zanvar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/neelam_zanvar/32/103116_2.png) [@Neelam\_Zanvar](https://discuss.elastic.co/u/Neelam_Zanvar)\
**Post date:** [September 8, 2023, 8:01am UTC](https://discuss.elastic.co/t/grok-pattern-matching-both-the-logs/342586/1 "2023-09-08T08:01:17Z")

</div>

Hi i have two types of logs, which differ just by one value at the end. can i get a single grok pattern to match both the files

```auto
[08/Sep/2023:13:28:50 +0530] | 404 | 1 ms | 773 B | 127.0.0.1 | - | - | - | "GET /status HTTP/1.1" | -

```

The last - in the field can be an email id or a -  
And another log is below

```auto
	
[08/Sep/2023:13:28:53 +0530] | 200 | 0 ms | 632 B | 172.31.6.240 | - | - | - | "GET /server-status?auto HTTP/1.1"

```

I've a grok for the entire thing except the last value

```auto
\[(?<short_date>%{HTTPDATE:date})\] \| %{NUMBER:response} \| (?<duration>%{NUMBER} %{WORD}) \| (?<bytes>%{NUMBER} %{WORD}|%{DATA}) \| %{IP:clientip} \| (%{SPACE}%{DATA:remoteip}|%{SPACE}%{IP:remoteip}) \| (%{WORD:token}|%{DATA:token}) \| (?<tag1>%{NUMBER} %{WORD}|%{DATA}) \| \"(?<method>%{WORD}) (?<url>%{URIPATHPARAM:service}) (?:HTTP/%{NUMBER:http_version})\"

```

What can i add to match both the logs?

---

<div class="post-metadata">

**Author:** ![ranjini](https://avatars.discourse-cdn.com/v4/letter/r/898d66/32.png) [@ranjini](https://discuss.elastic.co/u/ranjini)\
**Post date:** [September 8, 2023, 9:40am UTC](https://discuss.elastic.co/t/grok-pattern-matching-both-the-logs/342586/2 "2023-09-08T09:40:04Z")

</div>

Are you referring to log lines above. They Seems to already match.

```auto
[
  {
    "short_date": "08/Sep/2023:13:28:50 +0530",
    "date": "08/Sep/2023:13:28:50 +0530",
    "response": 404,
    "duration": "1 ms",
    "bytes": "773 B",
    "clientip": "127.0.0.1",
    "remoteip": "-",
    "token": "-",
    "tag1": "-",
    "method": "GET",
    "url": "/status",
    "service": "/status",
    "http_version": 1.1
  },
  {
    "short_date": "08/Sep/2023:13:28:53 +0530",
    "date": "08/Sep/2023:13:28:53 +0530",
    "response": 200,
    "duration": "0 ms",
    "bytes": "632 B",
    "clientip": "172.31.6.240",
    "remoteip": "-",
    "token": "-",
    "tag1": "-",
    "method": "GET",
    "url": "/server-status?auto",
    "service": "/server-status?auto",
    "http_version": 1.1
  }
]

```

---

<div class="post-metadata">

**Author:** ![Neelam\_Zanvar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/neelam_zanvar/32/103116_2.png) [@Neelam\_Zanvar](https://discuss.elastic.co/u/Neelam_Zanvar)\
**Post date:** [September 8, 2023, 10:44am UTC](https://discuss.elastic.co/t/grok-pattern-matching-both-the-logs/342586/3 "2023-09-08T10:44:36Z")

</div>

there is a difference of | - in both the log lines  
in one type of logs there is nothing after http version. and in another there is | - or | [email@test.com](mailto:email@test.com)

---

<div class="post-metadata">

**Author:** ![ranjini](https://avatars.discourse-cdn.com/v4/letter/r/898d66/32.png) [@ranjini](https://discuss.elastic.co/u/ranjini)\
**Post date:** [September 8, 2023, 12:31pm UTC](https://discuss.elastic.co/t/grok-pattern-matching-both-the-logs/342586/4 "2023-09-08T12:31:02Z")

</div>

You can have 2 patterns like

```auto
        "\[%{HTTPDATE:date}\] \| %{NUMBER:response:int} \| %{NUMBER:duration:int} ms \| %{NUMBER:bytes:int} B \| %{IP:clientip} \| (-|%{IP:remoteip}) \| (-|%{DATA:token}) \| (-|%{NUMBER} %{WORD}|%{DATA}) \| \"%{WORD:method} %{URIPATHPARAM:service}(?: HTTP/%{NUMBER:http_version})?(?: \| %{GREEDYDATA:extra_data}(?: \| %{EMAILADDRESS:email}))?",
        "\[%{HTTPDATE:date}\] \| %{NUMBER:response:int} \| %{NUMBER:duration:int} ms \| %{NUMBER:bytes:int} B \| %{IP:clientip} \| (-|%{IP:remoteip}) \| (-|%{DATA:token}) \| (-|%{NUMBER} %{WORD}|%{DATA}) \| \"%{WORD:method} %{URIPATHPARAM:service}(?: HTTP/%{NUMBER:http_version})?"

```

---

<div class="post-metadata">

**Author:** ![Neelam\_Zanvar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/neelam_zanvar/32/103116_2.png) [@Neelam\_Zanvar](https://discuss.elastic.co/u/Neelam_Zanvar)\
**Post date:** [September 11, 2023, 4:26am UTC](https://discuss.elastic.co/t/grok-pattern-matching-both-the-logs/342586/5 "2023-09-11T04:26:19Z")

</div>

can i have two match in same grok? because i want these both logs to be redirected to one index. i have two indexes, with a difference of just one field. one have email and one has nothing. i used to merge the two indexes in one data view. but now i want them to be in a single index and transport the data to another tool for further analysis.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 9, 2023, 4:26am UTC](https://discuss.elastic.co/t/grok-pattern-matching-both-the-logs/342586/6 "2023-10-09T04:26:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.