# How to use more than 1 pattern in pipelines?

**URL:** https://discuss.elastic.co/t/how-to-use-more-than-1-pattern-in-pipelines/72545
**Category:** Elasticsearch
**Created:** [January 23, 2017, 10:47pm UTC](https://discuss.elastic.co/t/how-to-use-more-than-1-pattern-in-pipelines/72545 "2017-01-23T22:47:56Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![kikecueva](https://avatars.discourse-cdn.com/v4/letter/k/c57346/32.png) [@kikecueva](https://discuss.elastic.co/u/kikecueva)
#### Post date: [January 23, 2017, 10:47pm UTC](https://discuss.elastic.co/t/how-to-use-more-than-1-pattern-in-pipelines/72545/1 "2017-01-23T22:47:56Z")

</div>

Hi guys,

I'm trying to define two different grok statements in my pipeline as I can receive more than 1 message pattern log.  
This is my pipeline simulation:

```
POST _ingest/pipeline/_simulate
{
  "pipeline": {
    "processors": [
      {
        "grok": {
          "field": "message",
          "patterns": [
            "%{SYSLOGTIMESTAMP} %{GREEDYDATA} %{LOGLEVEL:loglevel} \\[%{DATA:comp2}\\] %{GREEDYDATA:tibMsgCode} \\[%{DATA:action}\\] %{GREEDYDATA:msg}",
            "%{GREEDYDATA:msg}"
          ],
          "on_failure": [
            {
              "set": {
                "field": "_index",
                "value": "failed-{{ _index }}"
              }
            },
            {
              "set": {
                "field": "error",
                "value": "{{ _ingest.on_failure_message }}"
              }
            }
          ]
        }
      }
    ]
  },
  "docs": [
    {
      "_source": {
        "message": "2016 Nov 04 11:08:10:049 GMT +0000 : Keystore inited."
      },
      "_index": "index"
    }
  ]
}

```

And the output is:

```
{
  "docs": [
    {
      "doc": {
        "_id": "_id",
        "_type": "_type",
        "_index": "index",
        "_source": {
          "message": "2016 Nov 04 11:08:10:049 GMT +0000 : Keystore inited."
        },
        "_ingest": {
          "timestamp": "2017-01-23T22:32:30.891+0000"
        }
      }
    }
  ]
}

```

Correct if I'm wrong but it seems like is not picking any pattern defined and also is not triggering the on\_failure code, what could be wrong? If I change the order of the grok statements it throw something like this:

```
{
  "docs": [
    {
      "doc": {
        "_id": "_id",
        "_type": "_type",
        "_index": "index",
        "_source": {
          "msg": "2016 Nov 04 11:08:10:049 GMT +0000 : Keystore inited.",
          "message": "2016 Nov 04 11:08:10:049 GMT +0000 : Keystore inited."
        },
        "_ingest": {
          "timestamp": "2017-01-23T22:44:34.412+0000"
        }
      }
    }
  ]

```

Which seems to be working, but then if I try a different string like:

`"message": "2016 Nov 04 11:16:21:945 GMT +0000 Info [Application] AESDKJ-0000 [http-bio-8443-exec-68] [Query log files] The log file dummyApp has been queried by dummyUser."`

It won't match the desired grok statement.

Thanks in advance!

---

<div class="post-metadata">

### Author: ![kikecueva](https://avatars.discourse-cdn.com/v4/letter/k/c57346/32.png) [@kikecueva](https://discuss.elastic.co/u/kikecueva)
#### Post date: [January 24, 2017, 8:43pm UTC](https://discuss.elastic.co/t/how-to-use-more-than-1-pattern-in-pipelines/72545/2 "2017-01-24T20:43:34Z")

</div>

By the way I'm using ELK 5.1

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 21, 2017, 8:44pm UTC](https://discuss.elastic.co/t/how-to-use-more-than-1-pattern-in-pipelines/72545/3 "2017-02-21T20:44:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.