# How to specify a default value for my field in grok pattern match
**URL:** https://discuss.elastic.co/t/how-to-specify-a-default-value-for-my-field-in-grok-pattern-match/349310
**Category:** Elasticsearch
**Created:** [December 14, 2023, 1:43am UTC](https://discuss.elastic.co/t/how-to-specify-a-default-value-for-my-field-in-grok-pattern-match/349310 "2023-12-14T01:43:27Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@ameeto17](https://discuss.elastic.co/u/ameeto17)
#### Post date: [December 14, 2023, 1:43am UTC](https://discuss.elastic.co/t/how-to-specify-a-default-value-for-my-field-in-grok-pattern-match/349310/1 "2023-12-14T01:43:27Z")
I have a pattern to match using GROK
Dec 14 03:13:01 ppddc1kfep302 my-checker: **Context SHA** of VSP Logger Software da39a3ee5e6b4b0d3255bfef95601890afd80709
I have the format below for the match
%{SYSLOGTIMESTAMP}%{SPACE}%{IPORHOST:my\_host}%{SPACE}%{DATA}:%{SPACE}Context SHA of %{DATA:software} %{DATA:rel\_version} %{WORD:sha}
This works but as you can see rel\_version would be blank above but i want to specify that as a defualt value of 1.0.1. How can i do that?
Thanks in anticipation
---
### Author:  [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)
#### Post date: [December 14, 2023, 5:57am UTC](https://discuss.elastic.co/t/how-to-specify-a-default-value-for-my-field-in-grok-pattern-match/349310/2 "2023-12-14T05:57:01Z")
Hi, you can provide through mutate filter plugin
> **[Mutate filter plugin | Logstash Reference \[8.11\] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html)**
hope it works!
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [December 14, 2023, 8:38am UTC](https://discuss.elastic.co/t/how-to-specify-a-default-value-for-my-field-in-grok-pattern-match/349310/3 "2023-12-14T08:38:05Z")
Partly true Shrikant. He didn't mention what [he is trying](https://discuss.elastic.co/t/need-help-to-create-a-grok-patter-for-my-syslog-pattern/349103) by specifying several lines to figure out the pattern for:
> Dec 14 03:13:01 ppddc1kfep302 my-checker: Context SHA of VSP Logger Software da39a3ee5e6b4b0d3255bfef95601890afd80709
> Dec 12 12:01:27 ppdtest302 test-checker: Context SHA of TEST Software Version 3.0.1\_RC5 0b1f71223180bf0df9330b13e17f8d7c62dfdaad16b97a80b8a25c99409c1109
This pattern is working:
```auto
filter {
grok {
match => { "message" => "%{SYSLOGTIMESTAMP}%{SPACE}%{IPORHOST:my_host}%{SPACE}%{DATA}:%{SPACE}Context SHA of %{DATA:software} Software (%{DATA})?%{SPACE}(%{DATA:version})?%{SPACE}%{WORD:hash}" }
}
if (![version]){
mutate { add_field => {"version" => "1.0.1"} }
}
}
```
I assumed that version is an option filed as well as "Version" text. You cannot use "host" for the field name because LS is using as JSON. If you still want to use it, addd: `mutate{ remove_field => ["host"]` above grok.
---
### Author:  [@ameeto17](https://discuss.elastic.co/u/ameeto17)
#### Post date: [December 14, 2023, 10:33pm UTC](https://discuss.elastic.co/t/how-to-specify-a-default-value-for-my-field-in-grok-pattern-match/349310/4 "2023-12-14T22:33:32Z")
Thanks so much for this Rios. and for the detailed explanantion.
Yes you are right. I have logs that contain version and some that dont. Hence wanted to use multiple pattern matches to match all those conditions. Your example above is exactly what i needed.
I am using multiple pattern matches like that
```auto
"%{SYSLOGTIMESTAMP}%{SPACE}%{IPORHOST:xxx_host}%{SPACE}%{DATA}:%{SPACE}Context SHA of %{DATA:software} Software Version %{DATA:rel_version} %{WORD:sha}",
"%{SYSLOGTIMESTAMP}%{SPACE}%{IPORHOST:xxx_host}%{SPACE}%{DATA}:%{SPACE}Context SHA of %{DATA:software}%{SPACE}Software%{DATA:rel_version} %{WORD:sha}",
"%{SYSLOGTIMESTAMP}%{SPACE}%{IPORHOST:xxx_host}%{SPACE}%{DATA}:%{SPACE}Context SHA of %{DATA:software} %{DATA:rel_version} %{WORD:sha}"
```
Will go ahead and add the mutate part for the second match above where rel\_Version could be blank
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [December 14, 2023, 10:54pm UTC](https://discuss.elastic.co/t/how-to-specify-a-default-value-for-my-field-in-grok-pattern-match/349310/5 "2023-12-14T22:54:33Z")
No need for multiple match, just use the optional fields.
---
### Author:  [@ameeto17](https://discuss.elastic.co/u/ameeto17)
#### Post date: [December 15, 2023, 1:03am UTC](https://discuss.elastic.co/t/how-to-specify-a-default-value-for-my-field-in-grok-pattern-match/349310/6 "2023-12-15T01:03:31Z")
okies. sounds good. will try it out
---
### Author:  [@ameeto17](https://discuss.elastic.co/u/ameeto17)
#### Post date: [December 15, 2023, 1:11am UTC](https://discuss.elastic.co/t/how-to-specify-a-default-value-for-my-field-in-grok-pattern-match/349310/7 "2023-12-15T01:11:11Z")
> [@Rios](#):
>
> ```auto
> if (![version]){
> mutate { add_field => {"version" => "1.0.1"} }
> }
>
> ```
im wondering if i should use this instead of add field since version would get created anyways with a blank value. so instead of adding just update?
```auto
if (![version]){
mutate { update => {"version" => "1.0.1"} }
}
```
---
### Author:  [@ameeto17](https://discuss.elastic.co/u/ameeto17)
#### Post date: [December 15, 2023, 1:13am UTC](https://discuss.elastic.co/t/how-to-specify-a-default-value-for-my-field-in-grok-pattern-match/349310/8 "2023-12-15T01:13:22Z")
right now my final log looks like that with rel\_veersion (field name i have used is rel\_version) showing up with -
I want that to have 1.0.1
pattern i used was
```auto
%{SYSLOGTIMESTAMP}%{SPACE}%{IPORHOST:keno_host}%{SPACE}%{DATA}:%{SPACE}Context SHA of %{DATA:software}%{SPACE}Software%{DATA:rel_version} %{WORD:sha}"
```
that works perfectly to match this log pattern but need the rel\_version above to have 1.0.1
Dec 14 03:13:01 ppddc1kfep302 keno-checker: **Context SHA** of VSP Logger Software da39a3ee5e6b4b0d3255bfef95601890afd80709
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [December 15, 2023, 5:40am UTC](https://discuss.elastic.co/t/how-to-specify-a-default-value-for-my-field-in-grok-pattern-match/349310/9 "2023-12-15T05:40:06Z")
Use improved grok to handle both cases:
```auto
grok {
match => { "message" => "%{SYSLOGTIMESTAMP}%{SPACE}%{IPORHOST:my_host}%{SPACE}%{DATA}:%{SPACE}Context SHA of %{DATA:software} Software (%{WORD})?( %{DATA:version} )?%{WORD:hash}$" }
}
```
You cannot use update since field do not exist in case when is not created by grok.
The mark - means field do not exist.
---
### Author:  [@ameeto17](https://discuss.elastic.co/u/ameeto17)
#### Post date: [December 15, 2023, 5:53am UTC](https://discuss.elastic.co/t/how-to-specify-a-default-value-for-my-field-in-grok-pattern-match/349310/10 "2023-12-15T05:53:26Z")
> [@Rios](#):
>
> `add_field`
ok awesome. thanks once again. much appreciated.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 12, 2024, 5:53am UTC](https://discuss.elastic.co/t/how-to-specify-a-default-value-for-my-field-in-grok-pattern-match/349310/11 "2024-01-12T05:53:49Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.