# How many matches, we can have in grok filter - as example below
**URL:** https://discuss.elastic.co/t/how-many-matches-we-can-have-in-grok-filter-as-example-below/148415
**Category:** Logstash
**Created:** [September 13, 2018, 7:10am UTC](https://discuss.elastic.co/t/how-many-matches-we-can-have-in-grok-filter-as-example-below/148415 "2018-09-13T07:10:03Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@ramindia](https://discuss.elastic.co/u/ramindia)
#### Post date: [September 13, 2018, 7:10am UTC](https://discuss.elastic.co/t/how-many-matches-we-can-have-in-grok-filter-as-example-below/148415/1 "2018-09-13T07:10:04Z")
I have assorted logs coming to syslog file as one all.log, i am looking sort using different grok match, is this possible as below : match ?
input {
file {
path =\> "/var/syslog-ng/raw/\*.log"
start\_position =\> "beginning"
type =\> "logstash-syslog"
tags =\> ["logstash-syslog"]
}
}
filter {
grok {
match =\> {
```
[ "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{HOSTNAME:device_src} %{NUMBER} %{SYSLOGTIMESTAMP} %{WORD}: %{GREEDYDATA:syslog_message}",
"message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{HOSTNAME:device_src} %{GREEDYDATA:syslog_message}"]
}
}
date {
match => ["syslog_timestamp", "MMM dd HH:mm:ss"]
}
ruby {
code => "event.remove('type')"
```
}
}
output {
elasticsearch {
hosts =\> ["192.168.1.75:9200"]
index =\> "logstash-syslog"
}
stdout {
codec =\> rubydebug
}
}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [September 13, 2018, 9:38am UTC](https://discuss.elastic.co/t/how-many-matches-we-can-have-in-grok-filter-as-example-below/148415/2 "2018-09-13T09:38:43Z")
The documentation of the `match` option in the grok filter documentation contains an example of how to specify more than one expression.
---
### Author:  [@ramindia](https://discuss.elastic.co/u/ramindia)
#### Post date: [September 13, 2018, 10:08pm UTC](https://discuss.elastic.co/t/how-many-matches-we-can-have-in-grok-filter-as-example-below/148415/3 "2018-09-13T22:08:21Z")
this what i see in the document.
grok {
match =\> {
"message" =\> ["expr1", "expr2", ..., "exprN"]
}
}
is that mean, i can have 100 expression ? 30 different logs and log format stored in the same file
Curiosity do i consider delay, processing 100 expressions ?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [September 14, 2018, 6:12am UTC](https://discuss.elastic.co/t/how-many-matches-we-can-have-in-grok-filter-as-example-below/148415/4 "2018-09-14T06:12:33Z")
> is that mean, i can have 100 expression ? 30 different logs and log format stored in the same file
Yes.
> Curiosity do i consider delay, processing 100 expressions ?
Of course, but the grok filter doesn't always test all expressions. It terminates the search as soon as there's a match, so you'll want to sort the expressions in "most likely to match" order.
---
### Author:  [@ramindia](https://discuss.elastic.co/u/ramindia)
#### Post date: [September 14, 2018, 6:14am UTC](https://discuss.elastic.co/t/how-many-matches-we-can-have-in-grok-filter-as-example-below/148415/5 "2018-09-14T06:14:59Z")
Appreciate your reply.
> "most likely to match" order
This means, we should not have any generic expression which consumes more time to recursive lookup.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 12, 2018, 6:14am UTC](https://discuss.elastic.co/t/how-many-matches-we-can-have-in-grok-filter-as-example-below/148415/6 "2018-10-12T06:14:59Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.