# Grok Placement

**URL:** <https://discuss.elastic.co/t/grok-placement/34010>\
**Category:** Logstash\
**Created:** [November 6, 2015, 4:07pm UTC](https://discuss.elastic.co/t/grok-placement/34010 "2015-11-06T16:07:22Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jackal9301](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jackal9301/32/5748_2.png) [@Jackal9301](https://discuss.elastic.co/u/Jackal9301)\
**Post date:** [November 6, 2015, 4:07pm UTC](https://discuss.elastic.co/t/grok-placement/34010/1 "2015-11-06T16:07:22Z")

</div>

I am wondering about processing. Is there any benefit to putting a GROK pattern in the input rather than creating nested conditional statements in the filter?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 6, 2015, 5:14pm UTC](https://discuss.elastic.co/t/grok-placement/34010/2 "2015-11-06T17:14:10Z")

</div>

"Grok pattern in the input", what does that mean? Could you give example of the two cases you want to compare?

---

<div class="post-metadata">

**Author:** ![Jackal9301](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jackal9301/32/5748_2.png) [@Jackal9301](https://discuss.elastic.co/u/Jackal9301)\
**Post date:** [November 6, 2015, 7:03pm UTC](https://discuss.elastic.co/t/grok-placement/34010/3 "2015-11-06T19:03:00Z")

</div>

This is a very rough example of what i'm considering. This way in the filter below I wouldnt have to grok just to add a field to a single input with multiple log types coming in

```
input {udp { port => "514"
    grok{ 
        match => {"message" => "<%{BASE10NUM:LCE_log_num}>%{SYSLOGTIMESTAMP:LCE_time} %{NOTSPACE}: %{NOTSPACE} %{IP:Source_IP}:%{BASE10NUM:Source_Port} -> %{IP:Destination_IP}:%{BASE10NUM:Destination_Port} ::" }
		add_field => { "sort_num" => "%{LCE_log_num}" }
	}

 filter {
    if [sort_num] == "36"
        grok{
            match => {"message" => "%{PROG:Log_Type},%{DATE_US:Event_Date},%{TIME:Event_Time} %{WORD},%{PROG:Log},%{BASE10NUM},%{WORD:Error_id},%{PROG},%{WORD},%{PROG},%{HOST},IP:%{IP},%{BASE10NUM}}"
}

mutate{
}

output{
}
```

---

<div class="post-metadata">

**Author:** ![Jackal9301](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jackal9301/32/5748_2.png) [@Jackal9301](https://discuss.elastic.co/u/Jackal9301)\
**Post date:** [November 6, 2015, 7:48pm UTC](https://discuss.elastic.co/t/grok-placement/34010/4 "2015-11-06T19:48:31Z")

</div>

Can I use grok in the input section?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 6, 2015, 8:06pm UTC](https://discuss.elastic.co/t/grok-placement/34010/5 "2015-11-06T20:06:11Z")

</div>

No, grok is a filter that can only be placed in the filter section.

A typical solution to your problem is to segregate different kinds of messages by the `type` field and/or via tags and put conditionals on those fields/tags around the filters.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:23am UTC](https://discuss.elastic.co/t/grok-placement/34010/6 "2017-07-06T05:23:35Z")

</div>

Closed on July 6, 2017, 5:23am UTC