# Ingest Pipeline Grok filter ignores first pattern and matches second pattern when second pattern exists

**URL:** <https://discuss.elastic.co/t/ingest-pipeline-grok-filter-ignores-first-pattern-and-matches-second-pattern-when-second-pattern-exists/302645>\
**Category:** Elasticsearch\
**Tags:** ingest-pipeline\
**Created:** [April 18, 2022, 9:03pm UTC](https://discuss.elastic.co/t/ingest-pipeline-grok-filter-ignores-first-pattern-and-matches-second-pattern-when-second-pattern-exists/302645 "2022-04-18T21:03:45Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![kossde](https://avatars.discourse-cdn.com/v4/letter/k/f19dbf/32.png) [@kossde](https://discuss.elastic.co/u/kossde)\
**Post date:** [April 18, 2022, 9:03pm UTC](https://discuss.elastic.co/t/ingest-pipeline-grok-filter-ignores-first-pattern-and-matches-second-pattern-when-second-pattern-exists/302645/1 "2022-04-18T21:03:45Z")

</div>

Ingest Pipeline GROK filter:

```auto
  {
    "grok": {
      "field": "message",
      "patterns": [
        "\\s*Workstation Name:(?!\\t-)\\s*%{DATA:winlog.event_data.WorkstationName}\\n\\t.*",
        "%{GREEDYDATA:message}"
      ],
      "trace_match": true,
      "ignore_missing": true,
      "if": "ctx?.winlog?.event_data?.WorkstationName == null"
    }
  }

```

When the second pattern is added to the GROK filter in the Ingest Pipeline, the first pattern is ignored and the second pattern is matched. When I remove the second pattern, though, the first pattern is matched. Any idea why this is happening?

Message that's being matched:

````auto
An account was successfully logged on.

Subject:
	Security ID: S-1-0-0
	Account Name: -
	Account Domain: -
	Logon ID: 0x0

Logon Type: 3

Impersonation Level: Impersonation

New Logon:
	Security ID: S-1-5-18
	Account Name: ThisIsatest
	Account Domain: Company
	Logon ID: HexStuff
	Logon GUID: {GUID}

Process Information:
	Process ID: 0x0
	Process Name: -

Network Information:
	Workstation Name:	Test
	Source Network Address:	***********
	Source Port: 63218

Detailed Authentication Information:
	Logon Process: Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length: 0

This event is generated when a logon session is created. It is generated on the computer that was accessed```
````

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 16, 2022, 9:04pm UTC](https://discuss.elastic.co/t/ingest-pipeline-grok-filter-ignores-first-pattern-and-matches-second-pattern-when-second-pattern-exists/302645/2 "2022-05-16T21:04:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.