# How does logstash match?
**URL:** https://discuss.elastic.co/t/how-does-logstash-match/320610
**Category:** Logstash
**Created:** [December 6, 2022, 4:06pm UTC](https://discuss.elastic.co/t/how-does-logstash-match/320610 "2022-12-06T16:06:11Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@stefanocog](https://discuss.elastic.co/u/stefanocog)
#### Post date: [December 6, 2022, 4:06pm UTC](https://discuss.elastic.co/t/how-does-logstash-match/320610/1 "2022-12-06T16:06:11Z")
Hello,
I need to match some logs that differ only in one fields (`url`), I match with grok, each grok rule matches a log, so I have different filters but with different grok rules, but now I realize that some logs after doing the matches with grok they continue towards other filters and fields are added or removed because each game has its own rules, for example:
```auto
filter {
grok {
match => { "message" => "\"%{TIMESTAMP_ISO8601:timestamp}\"\|\"%{GREEDYDATA:url}path/to/match\"" }
add_field => ["service", "01"]
add_field => ["type", "send"]
}
mutate {
copy => { "timestamp" => "reponse" }
replace => { "url" => "%{url}path/to/match" }
}
}
filter {
grok {
match => { "message" => "\"%{TIMESTAMP_ISO8601:timestamp}\"\|\"%{GREEDYDATA:url}other/path/to/match\"" }
add_field => ["service", "01"]
add_field => ["type", "request"]
}
mutate {
copy => { "timestamp" => "request" }
replace => { "url" => "%{url}other/path/to/match" }
}
}
```
Now into the document of log that match the first rule i see the field `response` and `request`, I expected to see only `response`, same thing for the `url` field, I see the fields counted, `%{url}path/to/matchother/path/to/match`
Is there a way to define that once a grok match is done, the log shouldn't be processed anymore?
Thanks
---
### Author:  [@stefanocog](https://discuss.elastic.co/u/stefanocog)
#### Post date: [December 6, 2022, 4:41pm UTC](https://discuss.elastic.co/t/how-does-logstash-match/320610/2 "2022-12-06T16:41:56Z")
I solved with `add_field` into grok and with `if` out of grok
```auto
filter {
grok {
match => { "message" => "\"%{TIMESTAMP_ISO8601:timestamp}\"\|\"%{GREEDYDATA:url}path/to/match\"" }
add_field => ["service", "01"]
add_field => ["type", "send"]
add_field => ["grok_match", "service01-send"]
}
if ["grok_match"] == "service01-send" {
mutate {
copy => { "timestamp" => "response" }
replace => { "url" => "%{url}path/to/match" }
}
}
```
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [December 6, 2022, 4:42pm UTC](https://discuss.elastic.co/t/how-does-logstash-match/320610/3 "2022-12-06T16:42:27Z")
> [@stefanocog](#):
>
> Is there a way to define that once a grok match is done, the log shouldn't be processed anymore?
You could make additional processing conditional on there being a \_grokparsefailure tag, but things will scale better if you use a tag for sucess
```
grok { ... add_tag => ["grokked"] }
if "grokked" not in [tags] {
grok { ... add_tag => ["grokked"] }
# Plus other filters
end
if "grokked" not in [tags] {
grok { ... add_tag => ["grokked"] }
# Plus other filters
end
if "grokked" not in [tags] {
grok { ... add_tag => ["grokked"] }
# Plus other filters
end
```
---
### Author:  [@stefanocog](https://discuss.elastic.co/u/stefanocog)
#### Post date: [December 6, 2022, 4:54pm UTC](https://discuss.elastic.co/t/how-does-logstash-match/320610/4 "2022-12-06T16:54:14Z")
better to add a field or better a tag?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [December 6, 2022, 4:57pm UTC](https://discuss.elastic.co/t/how-does-logstash-match/320610/5 "2022-12-06T16:57:45Z")
I do not think it makes much difference.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 3, 2023, 4:57pm UTC](https://discuss.elastic.co/t/how-does-logstash-match/320610/6 "2023-01-03T16:57:53Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.