# Ingest pipepine not extracting date when matched on second pattern

**URL:** <https://discuss.elastic.co/t/ingest-pipepine-not-extracting-date-when-matched-on-second-pattern/68310>\
**Category:** Elasticsearch\
**Created:** [December 7, 2016, 2:08pm UTC](https://discuss.elastic.co/t/ingest-pipepine-not-extracting-date-when-matched-on-second-pattern/68310 "2016-12-07T14:08:11Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![dwjvaughan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dwjvaughan/32/10648_2.png) [@dwjvaughan](https://discuss.elastic.co/u/dwjvaughan)\
**Post date:** [December 7, 2016, 2:08pm UTC](https://discuss.elastic.co/t/ingest-pipepine-not-extracting-date-when-matched-on-second-pattern/68310/1 "2016-12-07T14:08:11Z")

</div>

I have an ingest pipeline that I want to use to extract specific errors and the date from and Oracle alert log. I have it working if the message contains an error, but not when it doesn't. Please see below:

```
post _ingest/pipeline/_simulate
{  
   "pipeline":{  
      "description":"grok test",
      "processors":[  
         {  
            "grok":{  
               "trace_match":true,
               "ignore_missing":true,
               "field":"message",
               "patterns":[  
                  "%{ORADATE:ora-date}(.|\n)*%{ORAERR:ora-err}",
                  "%{ORADATE:ora-date}"
               ],
               "pattern_definitions":{  
                  "ORADATE":"[A-z]{3} [A-z]{3} [0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2} [0-9]{4}",
                  "ORAERR":"ORA-[0-9]{5}"
               }
            }
         }
      ]
   },
   "docs":[  
      {  
         "_source":{  
            "message":"Wed Nov 30 14:34:48 2016\nORA-01555 caused by SQL statement below (SQL ID: xxxxxxxxxxxxxxxxx, Query Duration=0 sec, SCN: 0x0030.093d9a86):\nSELECT * FROM TABLE"
         }
      }
   ]
}

```

This creates two new fields, ora-date and ora-err filled out correctly. If I edit the part of the doc ORA-01555 so that it doesn't match the ORAERR regex, it doesn't even match the date. See response below:

```
{
  "docs": [
    {
      "doc": {
        "_type": "_type",
        "_id": "_id",
        "_index": "_index",
        "_source": {
          "message": "Wed Nov 30 14:34:48 2016\nORA-a01555 caused by SQL statement below (SQL ID: xxxxxxxxxxxxxxxxx, Query Duration=0 sec, SCN: 0x0030.093d9a86):\nSELECT * FROM TABLE"
        },
        "_ingest": {
          "_grok_match_index": "1",
          "timestamp": "2016-12-07T14:00:28.783+0000"
        }
      }
    }
  ]
}

```

One further thing to point out: "\_grok\_match\_index": "1" indicates that it is matching the second value of the patterns array, but ora-date is not being set? What am I missing here?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 4, 2017, 2:08pm UTC](https://discuss.elastic.co/t/ingest-pipepine-not-extracting-date-when-matched-on-second-pattern/68310/2 "2017-01-04T14:08:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.