# Is it okay to have multiple grok filter files?

**URL:** https://discuss.elastic.co/t/is-it-okay-to-have-multiple-grok-filter-files/224062
**Category:** Logstash
**Created:** [March 18, 2020, 9:51am UTC](https://discuss.elastic.co/t/is-it-okay-to-have-multiple-grok-filter-files/224062 "2020-03-18T09:51:58Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![calanon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/calanon/32/64004_2.png) [@calanon](https://discuss.elastic.co/u/calanon)
#### Post date: [March 18, 2020, 9:51am UTC](https://discuss.elastic.co/t/is-it-okay-to-have-multiple-grok-filter-files/224062/1 "2020-03-18T09:51:58Z")

</div>

I wanted to have a clean structure with my grok filters. For example I have php, nginx and a bunch of other filters for some of my application logs.

Would it therefore be okay to have for example:

11-nginx.conf  
13-php.conf  
14-applogs.conf

In my present structure I have if statements that state the following:

```
filter {
  if [log][file][path] == "/var/log/nginx/access.log"{
     grok {
         patterns_dir => ["/etc/logstash/patterns"]
         match => { "message" => "%{NGINX_ACCESS}" }
    }
  }
  else if [log][file][path] == "/var/log/nginx/error.log" {
     grok {
         patterns_dir => ["/etc/logstash/patterns"]
         match => { "message" => "%{NGINX_ERROR}" }
    }
  }
  else {
     grok {
         patterns_dir => ["/etc/logstash/patterns"]

```

Is it necessary to carry on with this if statement approach if the rules are separated into different conf files?

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 18, 2020, 3:47pm UTC](https://discuss.elastic.co/t/is-it-okay-to-have-multiple-grok-filter-files/224062/2 "2020-03-18T15:47:47Z")

</div>

> [@calanon](#):
>
> Is it necessary to carry on with this if statement approach if the rules are separated into different conf files?

If you have filters defined in multiple files and they are running in the same pipeline then they are concetenated into a single filter section by logstash, so yes, the conditionals are required. If you are using multiple pipelines they may or may not be needed.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 15, 2020, 3:47pm UTC](https://discuss.elastic.co/t/is-it-okay-to-have-multiple-grok-filter-files/224062/3 "2020-04-15T15:47:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
