# How to grok log file with 2 line formats?

**URL:** <https://discuss.elastic.co/t/how-to-grok-log-file-with-2-line-formats/141136>\
**Category:** Logstash\
**Created:** [July 23, 2018, 10:05am UTC](https://discuss.elastic.co/t/how-to-grok-log-file-with-2-line-formats/141136 "2018-07-23T10:05:28Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![med\_amine](https://avatars.discourse-cdn.com/v4/letter/m/a88e4f/32.png) [@med\_amine](https://discuss.elastic.co/u/med_amine)\
**Post date:** [July 23, 2018, 10:05am UTC](https://discuss.elastic.co/t/how-to-grok-log-file-with-2-line-formats/141136/1 "2018-07-23T10:05:28Z")

</div>

iughikugkgkjk

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 23, 2018, 12:07pm UTC](https://discuss.elastic.co/t/how-to-grok-log-file-with-2-line-formats/141136/2 "2018-07-23T12:07:36Z")

</div>

You can pass grok an array of patterns and it will try each in turn. Like this...

```
    grok {
        match => { "message" => [
            '^%{IPORHOST:clientip} - - \[%{HTTPDATE:time_local}\] "%{WORD:action} /%{DATA:application}/%{DATA:ressource}%{WORD}=%{DATA:SAG} %{WORD:protocol}/%{NUMBER:protocol_num}" %{INT:status} %{NUMBER:bytes_sent} %{DATA} "%{DATA:http_user_agent}" %{DATA} %{IP:Address}:%{NUMBER:port_num} %{NUMBER:value1} %{NUMBER:value2} %{NUMBER:value3}',
            '^%{IPORHOST:clientip} - - \[%{HTTPDATE:time_local}\] "%{WORD:action} /%{DATA:application}/%{DATA:ressource}%{WORD}=%{DATA:SAG} %{WORD:protocol}/%{NUMBER:protocol_num}" %{INT:status} %{NUMBER:bytes_sent} %{DATA} "%{DATA:http_user_agent}" %{DATA} %{IP:fe1}:%{NUMBER:port_num1}, %{IP:fe2}:%{NUMBER:port_num2} %{NUMBER:value1}, - %{BASE10NUM:value2}, - %{BASE10NUM:value3}, - %{BASE10NUM:value4}'
            ]
        }

```

If a line would fit multiple patterns (not the case here) you need to make sure the more specific pattern is earlier in the list.

---

<div class="post-metadata">

**Author:** ![med\_amine](https://avatars.discourse-cdn.com/v4/letter/m/a88e4f/32.png) [@med\_amine](https://discuss.elastic.co/u/med_amine)\
**Post date:** [July 23, 2018, 1:12pm UTC](https://discuss.elastic.co/t/how-to-grok-log-file-with-2-line-formats/141136/3 "2018-07-23T13:12:11Z")

</div>

buhjklgbk

---

<div class="post-metadata">

**Author:** ![med\_amine](https://avatars.discourse-cdn.com/v4/letter/m/a88e4f/32.png) [@med\_amine](https://discuss.elastic.co/u/med_amine)\
**Post date:** [July 23, 2018, 1:17pm UTC](https://discuss.elastic.co/t/how-to-grok-log-file-with-2-line-formats/141136/4 "2018-07-23T13:17:29Z")

</div>

thank u very much !! it works now !!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 20, 2018, 1:17pm UTC](https://discuss.elastic.co/t/how-to-grok-log-file-with-2-line-formats/141136/5 "2018-08-20T13:17:32Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.