# How to use Logstash to perform multi-attribute missing tagging on log data?

**URL:** <https://discuss.elastic.co/t/how-to-use-logstash-to-perform-multi-attribute-missing-tagging-on-log-data/365651>\
**Category:** Logstash\
**Created:** [August 28, 2024, 3:15am UTC](https://discuss.elastic.co/t/how-to-use-logstash-to-perform-multi-attribute-missing-tagging-on-log-data/365651 "2024-08-28T03:15:36Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![WeirdorPersist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/weirdorpersist/32/137046_2.png) [@WeirdorPersist](https://discuss.elastic.co/u/WeirdorPersist)\
**Post date:** [August 28, 2024, 3:15am UTC](https://discuss.elastic.co/t/how-to-use-logstash-to-perform-multi-attribute-missing-tagging-on-log-data/365651/1 "2024-08-28T03:15:37Z")

</div>

I want to mark log data with missing attributes, but the results always do not match my expectations.  
The following is an example of normal log data：  
14.49.42.25 - - [12/May/2019:01:24:44 +0000] "GET /articles/ppp-over-ssh/ HTTP/1.1" 200 18586 "-" "Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2b1) Gecko/20091014 Firefox/3.6b1 GTB5"  
But i want to mark log data with missing attributes,for example:  
14.49.42.25 - - [12/May/2019:01:24:44 +0000] "GET /articles/ppp-over-ssh/ HTTP/1.1" 200 "-" "Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2b1) Gecko/20091014 Firefox/3.6b1 GTB5",the bytes is missing.  
My configuration file is as follows：  
input{  
stdin{}  
}

filter {  
grok {  
match =\> { "message" =\> '%{IPORHOST:clientip} %{USER:ident} %{USER:auth} [%{HTTPDATE:timestamp}] "(?:%{WORD:method} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})" %{NUMBER:response} %{NUMBER:bytes} "(?:%{URI:referrer}|-)" "(?:%{DATA:agent})"' }  
}

if [clientip] =="" or ![clientip]{  
mutate{  
add\_field =\> { "clientip\_status" =\> "missing"}  
}  
}  
if [bytes] == "" or ![bytes]{  
mutate{  
add\_field =\> { "bytes\_status" =\> "missing"}  
}  
}  
}

output {  
stdout { }  
}  
give the result as follows：  
{  
"bytes\_status" =\> "missing",  
"@version" =\> "1",  
"@timestamp" =\> 2024-08-28T02:33:59.895177595Z,  
"message" =\> "14.49.42.25 - - [12/May/2019:01:24:44 +0000] "GET /articles/ppp-over-ssh/ HTTP/1.1" 200 "-" "Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2b1) Gecko/20091014 Firefox/3.6b1 GTB5"",  
"clientip\_status" =\> "missing",  
"host" =\> {  
"hostname" =\> "nskeylab-PowerEdge-R250"  
},  
"tags" =\> [  
[0] "\_grokparsefailure"  
],  
"event" =\> {  
"original" =\> "14.49.42.25 - - [12/May/2019:01:24:44 +0000] "GET /articles/ppp-over-ssh/ HTTP/1.1" 200 "-" "Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2b1) Gecko/20091014 Firefox/3.6b1 GTB5""  
}  
}  
Why is this result？Can anyone help me?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 28, 2024, 1:26pm UTC](https://discuss.elastic.co/t/how-to-use-logstash-to-perform-multi-attribute-missing-tagging-on-log-data/365651/2 "2024-08-28T13:26:46Z")

</div>

You are getting a \_grokparsefailure because `%{NUMBER:bytes} ` is a required field in your pattern, but, as you know, it is missing in the second log line. So make it optional. Change

```
%{NUMBER:response} %{NUMBER:bytes} "(?:%{URI:referrer}|-)"

```

to

```
%{NUMBER:response} (%{NUMBER:bytes} )?"(?:%{URI:referrer}|-)"

```

---

<div class="post-metadata">

**Author:** ![WeirdorPersist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/weirdorpersist/32/137046_2.png) [@WeirdorPersist](https://discuss.elastic.co/u/WeirdorPersist)\
**Post date:** [August 29, 2024, 2:00am UTC](https://discuss.elastic.co/t/how-to-use-logstash-to-perform-multi-attribute-missing-tagging-on-log-data/365651/3 "2024-08-29T02:00:51Z")

</div>

Thank you very much, I'm just starting to learn these contents and I'm a bit unfamiliar with Grok。So if I want to determine if every attribute is missing, I need to process all attributes in this way?