# How to add multiple grok pattern in one filter?
**URL:** https://discuss.elastic.co/t/how-to-add-multiple-grok-pattern-in-one-filter/128622
**Category:** Logstash
**Created:** [April 19, 2018, 4:45am UTC](https://discuss.elastic.co/t/how-to-add-multiple-grok-pattern-in-one-filter/128622 "2018-04-19T04:45:12Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@RameshNagargoje](https://discuss.elastic.co/u/RameshNagargoje)
#### Post date: [April 19, 2018, 4:45am UTC](https://discuss.elastic.co/t/how-to-add-multiple-grok-pattern-in-one-filter/128622/1 "2018-04-19T04:45:12Z")
Hi,
My use case is to match one of the regex using multiple grok in one filter.Tried using multiple filter but not matching one of the pattern even though that pattern is present in input.
Here is my filter
filter
{
json
{
source =\> "message"
target =\> "message"
}
if[type] == 'dmesg'
{
```
grok
{
match => { logs => "killed by TERM signal" }
add_field => {"tagName"=>"GENERIC_EMERGENCY"}
add_field => {"module" => "null"}
}
grok
{
match => { logs => "^<1>" }
add_field => {"tagName"=>"GENERIC_ALERT"}
add_field => {"module" => "null"}
}
grok
{
match => { logs => "^<3>" }
add_field => {"tagName"=>"GENERIC_ERROR"}
add_field => {"module" => "null"}
}
grok
{
match => { logs => "^<4>" }
add_field => {"tagName"=>"GENERIC_WARNING"}
add_field => {"module" => "null"}
}
}
```
if "\_grokparsefailure" in [tags]
{
drop { }
}
}
---
### Author:  [@RameshNagargoje](https://discuss.elastic.co/u/RameshNagargoje)
#### Post date: [April 19, 2018, 4:45am UTC](https://discuss.elastic.co/t/how-to-add-multiple-grok-pattern-in-one-filter/128622/2 "2018-04-19T04:45:51Z")
@magnusbaeck please have look
---
### Author:  [@MariumHassan](https://discuss.elastic.co/u/MariumHassan)
#### Post date: [April 19, 2018, 5:40am UTC](https://discuss.elastic.co/t/how-to-add-multiple-grok-pattern-in-one-filter/128622/3 "2018-04-19T05:40:18Z")
Hi,
This can be easily achieved by using multiple grok patterns. You need to do something like this:
```auto
grok
{
match => { "message" => "killed by TERM signal" }
add_field =>
{
"tagName"=> "GENERIC_EMERGENCY"
"module" => "null"
}
}
```
It matches "message" with the pattern. Sorry If I am getting it wrong but what is "logs" in your case? Do you get it in json format as a field?
---
### Author:  [@RameshNagargoje](https://discuss.elastic.co/u/RameshNagargoje)
#### Post date: [April 19, 2018, 5:41am UTC](https://discuss.elastic.co/t/how-to-add-multiple-grok-pattern-in-one-filter/128622/4 "2018-04-19T05:41:49Z")
yes i get logs as input instead of message.
---
### Author:  [@MariumHassan](https://discuss.elastic.co/u/MariumHassan)
#### Post date: [April 19, 2018, 5:51am UTC](https://discuss.elastic.co/t/how-to-add-multiple-grok-pattern-in-one-filter/128622/5 "2018-04-19T05:51:52Z")
Try using this:
```auto
grok
{
match => ["message" , "killed by TERM signal"]
add_field =>
{
"tagName"=> "GENERIC_EMERGENCY"
"module" => "null"
}
}
```
What you get as an input is stored in "message". Try to match it with one pattern just to see if it is working fine, and then you can add multiple grok patterns in your file.
Can you share json of your logs simply using this?
```auto
output
{
stdout { codec => rubydebug }
}
```
---
### Author:  [@RameshNagargoje](https://discuss.elastic.co/u/RameshNagargoje)
#### Post date: [April 19, 2018, 10:23am UTC](https://discuss.elastic.co/t/how-to-add-multiple-grok-pattern-in-one-filter/128622/6 "2018-04-19T10:23:01Z")
thanks @MariumHassan
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 17, 2018, 10:23am UTC](https://discuss.elastic.co/t/how-to-add-multiple-grok-pattern-in-one-filter/128622/7 "2018-05-17T10:23:28Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.