# How does "Keep\_empty\_captures" work

**URL:** <https://discuss.elastic.co/t/how-does-keep-empty-captures-work/25657>\
**Category:** Logstash\
**Created:** [July 15, 2015, 5:34pm UTC](https://discuss.elastic.co/t/how-does-keep-empty-captures-work/25657 "2015-07-15T17:34:51Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![DavidL](https://avatars.discourse-cdn.com/v4/letter/d/ecc23a/32.png) [@DavidL](https://discuss.elastic.co/u/DavidL)\
**Post date:** [July 15, 2015, 5:34pm UTC](https://discuss.elastic.co/t/how-does-keep-empty-captures-work/25657/1 "2015-07-15T17:34:51Z")

</div>

I am trying to used this grok pattern  
%{Myfield:Path}\t%{Myfield:Status}\t\t%{Myfield:model\_package}

to parse out this two

/folder/1/2\tSuccess\t\tsometext,

/folder/1/2\t\t\tsometext,

I turned on Keep\_Empty\_Captures, but still, the pattern only captures the first one but give me a \_grokparserfailure for second one.

I thought Keep\_empty\_captures servies this purpose, but apparently it doesn't. Can anyone help me with this?  
Are there ways to keep the status field for second log with the same grok pattern? Thanks in advance.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:34am UTC](https://discuss.elastic.co/t/how-does-keep-empty-captures-work/25657/2 "2017-07-06T05:34:34Z")

</div>

Closed on July 6, 2017, 5:34am UTC