# How to try many grok matches, and take only the one that works?

**URL:** <https://discuss.elastic.co/t/how-to-try-many-grok-matches-and-take-only-the-one-that-works/111743>\
**Category:** Logstash\
**Created:** [December 14, 2017, 10:41am UTC](https://discuss.elastic.co/t/how-to-try-many-grok-matches-and-take-only-the-one-that-works/111743 "2017-12-14T10:41:58Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![yishain11](https://avatars.discourse-cdn.com/v4/letter/y/df705f/32.png) [@yishain11](https://discuss.elastic.co/u/yishain11)\
**Post date:** [December 14, 2017, 10:41am UTC](https://discuss.elastic.co/t/how-to-try-many-grok-matches-and-take-only-the-one-that-works/111743/1 "2017-12-14T10:41:58Z")

</div>

Hi everyone!  
I have 10 types of logs I need to process. They differ from each other but have some similarities, so I built a grok filter that matches each one, and non of the other types. How do I write it into the .conf logstash file so that the filter will analyze the log with the right grok match?  
Plus, How to I turn the grok categories into aggregatable fields in kibana?

What I'm looking for is something like this:

```
filter{
    grok{
        match => {"messade" => grokPattern}
    }
if no match:
    grok{
        match => {"messade" => anotherGrokPattern}
    }
...
}

```

Any tips?  
Thanks!

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [December 14, 2017, 11:41am UTC](https://discuss.elastic.co/t/how-to-try-many-grok-matches-and-take-only-the-one-that-works/111743/2 "2017-12-14T11:41:47Z")

</div>

> I have 10 types of logs I need to process. They differ from each other but have some similarities, so I built a grok filter that matches each one, and non of the other types. How do I write it into the .conf logstash file so that the filter will analyze the log with the right grok match?

You can list multiple grok expressions in the same grok filter. See example at [Grok filter plugin | Logstash Reference [8.11] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html#plugins-filters-grok-match).

> Plus, How to I turn the grok categories into aggregatable fields in kibana?

What's a "grok category"?

---

<div class="post-metadata">

**Author:** ![yishain11](https://avatars.discourse-cdn.com/v4/letter/y/df705f/32.png) [@yishain11](https://discuss.elastic.co/u/yishain11)\
**Post date:** [December 14, 2017, 11:51am UTC](https://discuss.elastic.co/t/how-to-try-many-grok-matches-and-take-only-the-one-that-works/111743/3 "2017-12-14T11:51:49Z")

</div>

Thanks for the reply!

A: if I match multiple grok expression does it add "grok parse failure" tag when it's tryting to match grok pattern that dosen't match?

B: "grok pattern" is, for example, if I have grok pattern like: {INT:accuontNum} I want to aggregate in kibana by this.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [December 14, 2017, 11:54am UTC](https://discuss.elastic.co/t/how-to-try-many-grok-matches-and-take-only-the-one-that-works/111743/4 "2017-12-14T11:54:30Z")

</div>

> if I match multiple grok expression does it add "grok parse failure" tag when it's tryting to match grok pattern that dosen't match?

The `_grokparsefailure` tag will be added if none of the expressions match.

> "grok pattern" is, for example, if I have grok pattern like: {INT:accuontNum} I want to aggregate in kibana by this.

You want to aggregate on the `accountNum` field? That's possible by default; you don't have to do anything special.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 11, 2018, 11:54am UTC](https://discuss.elastic.co/t/how-to-try-many-grok-matches-and-take-only-the-one-that-works/111743/5 "2018-01-11T11:54:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.