# Group errors messages by type

**URL:** <https://discuss.elastic.co/t/group-errors-messages-by-type/173943>\
**Category:** Logstash\
**Created:** [March 26, 2019, 2:02pm UTC](https://discuss.elastic.co/t/group-errors-messages-by-type/173943 "2019-03-26T14:02:17Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ebisu](https://avatars.discourse-cdn.com/v4/letter/e/3ab097/32.png) [@Ebisu](https://discuss.elastic.co/u/Ebisu)\
**Post date:** [March 26, 2019, 2:02pm UTC](https://discuss.elastic.co/t/group-errors-messages-by-type/173943/1 "2019-03-26T14:02:17Z")

</div>

So let's say we have a few dozen different _types_ of error messages in our logs, but with no error codes by which we could easily group them. Those messages have a form that could be parsed by grok like this:

> Could not open %{DATA} in %{DATA}  
> Host %{IP} unreachable

I want to group those messages by _type._ I know the correct matching expressions, I just don't want what is _variable_ about them in my field. For example, two messages `Host 196.138.2.8 unreachable` and `Host 88.143.7.19 unreachable` should both get the string `Host _ unreachable` in a field `error_type` in their events.

Could you give me a hint how to best approach this? Is there a shorter way than to use if-clauses and `mutate` (`add_field`)?

---

<div class="post-metadata">

**Author:** ![AquaX](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aquax/32/92006_2.png) [@AquaX](https://discuss.elastic.co/u/AquaX)\
**Post date:** [March 26, 2019, 6:33pm UTC](https://discuss.elastic.co/t/group-errors-messages-by-type/173943/2 "2019-03-26T18:33:09Z")

</div>

You could setup multiple grok filters and patterns and add a tag for each one that matches. Asuming, of course, that each error message is unique enough for there to be grok patterns that are specific enough for each kind of error message.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 23, 2019, 6:33pm UTC](https://discuss.elastic.co/t/group-errors-messages-by-type/173943/3 "2019-04-23T18:33:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.