# Is logstash supports multiple grok pattern?

**URL:** <https://discuss.elastic.co/t/is-logstash-supports-multiple-grok-pattern/358393>\
**Category:** Logstash\
**Tags:** elastic-stack-monitoring\
**Created:** [April 29, 2024, 6:29am UTC](https://discuss.elastic.co/t/is-logstash-supports-multiple-grok-pattern/358393 "2024-04-29T06:29:33Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![abhishekacharya828](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abhishekacharya828/32/133560_2.png) [@abhishekacharya828](https://discuss.elastic.co/u/abhishekacharya828)\
**Post date:** [April 29, 2024, 6:29am UTC](https://discuss.elastic.co/t/is-logstash-supports-multiple-grok-pattern/358393/1 "2024-04-29T06:29:33Z")

</div>

filter {  
grok {  
match =\> { "message" =\> [  
"%{TIMESTAMP\_ISO8601:timestamp} [%{LOGLEVEL:loglevel}] %{GREEDYDATA:message}",

```
  "\[%{LOGLEVEL:log_level}\] System Metrics: CPU %{NUMBER:cpu_usage}%\, Memory %{NUMBER:memory_usage}%\, Disk %{NUMBER:disk_usage}%\, Network In %{NUMBER:network_in} Mbps\, Out %{NUMBER:network_out} Mbps \| App Metrics: Requests %{NUMBER:request_time}\, Avg Response %{NUMBER:avg_response_time}ms\, Errors %{NUMBER:error_rate}%"

]}

```

}  
}

here this is the configuration is my logstash , because my logs contain multiple grok pattern so verify this should be correct or not ?

---

<div class="post-metadata">

**Author:** ![abhishekacharya828](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abhishekacharya828/32/133560_2.png) [@abhishekacharya828](https://discuss.elastic.co/u/abhishekacharya828)\
**Post date:** [April 29, 2024, 6:32am UTC](https://discuss.elastic.co/t/is-logstash-supports-multiple-grok-pattern/358393/2 "2024-04-29T06:32:30Z")

</div>

like this

 ![Screenshot from 2024-04-29 12-01-53](https://us1.discourse-cdn.com/elastic/original/3X/f/7/f7983e38af48f28802b6b6020b0349ba6fdfbbd8.png)

---

<div class="post-metadata">

**Author:** ![Nabeel\_Ahmed\_NAK](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nabeel_ahmed_nak/32/133673_2.png) [@Nabeel\_Ahmed\_NAK](https://discuss.elastic.co/u/Nabeel_Ahmed_NAK)\
**Post date:** [April 29, 2024, 6:44am UTC](https://discuss.elastic.co/t/is-logstash-supports-multiple-grok-pattern/358393/3 "2024-04-29T06:44:29Z")

</div>

Hi @abhishekacharya828

Yes, Logstash grok filter plugin support multiple pattern to parse data.

Thanks

---

<div class="post-metadata">

**Author:** ![Nabeel\_Ahmed\_NAK](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nabeel_ahmed_nak/32/133673_2.png) [@Nabeel\_Ahmed\_NAK](https://discuss.elastic.co/u/Nabeel_Ahmed_NAK)\
**Post date:** [April 29, 2024, 6:46am UTC](https://discuss.elastic.co/t/is-logstash-supports-multiple-grok-pattern/358393/4 "2024-04-29T06:46:31Z")

</div>

Just need to follow available options that logstash provided to you.  
for example:

> **[Grok filter plugin | Logstash Reference \[8.13\] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html#plugins-filters-grok-overwrite)**

Thanks