# How to create different actions for different log patterns by grok

**URL:** <https://discuss.elastic.co/t/how-to-create-different-actions-for-different-log-patterns-by-grok/182608>\
**Category:** Logstash\
**Created:** [May 24, 2019, 10:03am UTC](https://discuss.elastic.co/t/how-to-create-different-actions-for-different-log-patterns-by-grok/182608 "2019-05-24T10:03:58Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![rijinmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rijinmp/32/24634_2.png) [@rijinmp](https://discuss.elastic.co/u/rijinmp)\
**Post date:** [May 24, 2019, 10:03am UTC](https://discuss.elastic.co/t/how-to-create-different-actions-for-different-log-patterns-by-grok/182608/1 "2019-05-24T10:03:58Z")

</div>

Hi All ,

I have a log set . Only the time stamp is the common factor . All other part of the log is some java errors . Doesn't have any common structure. I am categorizing the error types by particular word's presence in the log . I need to take some actions based on the error types.

Example detected grok patterns 🙂

1. %{TIMESTAMP\_ISO8601:Date}%{GREEDYDATA:Log}ABCD%{GREEDYDATA:Log}KLM%{GREEDYDATA:Log}
2. %{TIMESTAMP\_ISO8601:Date}%{GREEDYDATA:Log}1234%{GREEDYDATA:Log}89%{GREEDYDATA:Log}
3. %{TIMESTAMP\_ISO8601:Date}%{GREEDYDATA:Log}XXX%{GREEDYDATA:Log}YYY%{GREEDYDATA:Log}

How can I create actions for these three types of patterns?

Example 🙂

if pattern 1  
Then  
mutate {  
add\_field =\> { "Error\_Type" =\> "ABCD" }  
add\_field =\> { "Caused\_By" =\> "KLM"}  
}

if pattern 2  
Then  
mutate {  
add\_field =\> { "Error\_Type" =\> "1234" }  
add\_field =\> { "Caused\_By" =\> "89"}  
}

---

<div class="post-metadata">

**Author:** ![pastechecker](https://avatars.discourse-cdn.com/v4/letter/p/0ea827/32.png) [@pastechecker](https://discuss.elastic.co/u/pastechecker)\
**Post date:** [May 24, 2019, 10:08am UTC](https://discuss.elastic.co/t/how-to-create-different-actions-for-different-log-patterns-by-grok/182608/2 "2019-05-24T10:08:54Z")

</div>

Try the following approach:

```
grok {
break_on_match => true
match => { "field" => "%{TIMESTAMP_ISO8601:Date}%{GREEDYDATA:Log}ABCD%{GREEDYDATA:Log}KLM%{GREEDYDATA:Log}"}
add_tag => "tag1"
}

if [tags] =~ /tag1/{
mutate {
add_field => { "Error_Type" => "1234" }
add_field => { "Caused_By" => "89"}
}
}

```

Think also about anchoring your patterns with ^ and $.

---

<div class="post-metadata">

**Author:** ![rijinmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rijinmp/32/24634_2.png) [@rijinmp](https://discuss.elastic.co/u/rijinmp)\
**Post date:** [May 24, 2019, 10:12am UTC](https://discuss.elastic.co/t/how-to-create-different-actions-for-different-log-patterns-by-grok/182608/3 "2019-05-24T10:12:51Z")

</div>

@pastechecker

Thank you so much . Trying this solution 🙂

---

<div class="post-metadata">

**Author:** ![rijinmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rijinmp/32/24634_2.png) [@rijinmp](https://discuss.elastic.co/u/rijinmp)\
**Post date:** [May 24, 2019, 10:32am UTC](https://discuss.elastic.co/t/how-to-create-different-actions-for-different-log-patterns-by-grok/182608/4 "2019-05-24T10:32:21Z")

</div>

How can I check the 3 patterns same time ?

(Nested if or else if condition )

---

<div class="post-metadata">

**Author:** ![pastechecker](https://avatars.discourse-cdn.com/v4/letter/p/0ea827/32.png) [@pastechecker](https://discuss.elastic.co/u/pastechecker)\
**Post date:** [May 24, 2019, 11:13am UTC](https://discuss.elastic.co/t/how-to-create-different-actions-for-different-log-patterns-by-grok/182608/5 "2019-05-24T11:13:53Z")

</div>

> [@pastechecker](#):
>
> if [tags] =~ /tag1/{

if [tags] =~ /tag1|tag2|tag3/{}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 21, 2019, 11:13am UTC](https://discuss.elastic.co/t/how-to-create-different-actions-for-different-log-patterns-by-grok/182608/6 "2019-06-21T11:13:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.