# Grok Plugin: load custom patterns in Oniguruma format from file

**URL:** <https://discuss.elastic.co/t/grok-plugin-load-custom-patterns-in-oniguruma-format-from-file/311108>\
**Category:** Logstash\
**Created:** [August 1, 2022, 11:52am UTC](https://discuss.elastic.co/t/grok-plugin-load-custom-patterns-in-oniguruma-format-from-file/311108 "2022-08-01T11:52:44Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![who](https://avatars.discourse-cdn.com/v4/letter/w/cdc98d/32.png) [@who](https://discuss.elastic.co/u/who)\
**Post date:** [August 1, 2022, 11:52am UTC](https://discuss.elastic.co/t/grok-plugin-load-custom-patterns-in-oniguruma-format-from-file/311108/1 "2022-08-01T11:52:44Z")

</div>

According to [the documentation](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html#_custom_patterns), we can use Oniguruma regex pattern formats in grok plugin (i.e. `(?<field_name>the pattern here)`).  
Also, there's the [patterns\_dir configuration option](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html#plugins-filters-grok-patterns_dir) that instructs grok filter to load patterns from files.

However, the format of patterns in files should be `NAME PATTERN` (presumably in each line). But I need to save patterns in files like below:

```auto
Patterns.txt file:

(?<field_name>the pattern 1 here)
(?<field_name>the pattern 2 here))

```

And then use these patterns in a way that do the same this as this configuration:

```auto
grok {
       match => {
         "message" => [
                  "(?<field_name>the pattern 1 here)",
                  "(?<field_name>the pattern 2 here)"
        ]
    }
}

```

So that the `message` field is being tested against multiple Oniguruma patterns, that are loaded from an external pattern file.

How would it be possible?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 29, 2022, 11:52am UTC](https://discuss.elastic.co/t/grok-plugin-load-custom-patterns-in-oniguruma-format-from-file/311108/2 "2022-08-29T11:52:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.