### Author:  [@Josh\_Reichardt](https://discuss.elastic.co/u/Josh_Reichardt)
#### Post date: [June 14, 2016, 10:21pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-tag-for-different-grok-matches/52785/1 "2016-06-14T22:21:56Z")
I am using the GELF Docker driver to send logs to Logstash. It has been working well so far but I am having trouble finding a good way to separate nginx access logs and nginx error logs. I was thinking that I would just add a take for each match like the following:
```auto
if [image_name] =~ /nginx/ {
grok {
match => ["message", "%{INT:status} - %{NOTSPACE:referrer} - %{NOTSPACE:domain} - %{IPORHOST:clientip} - %{QS:request} %{INT:body_bytes_sent} %{QS:http_referer}"]
add_tag => ["nginx_access"]
}
grok {
match => ["message", "(?%{YEAR}[./]%{MONTHNUM}[./]%{MONTHDAY} %{TIME}) \[%{LOGLEVEL:severity}\] %{POSINT:pid}#%{NUMBER}: \*%{NUMBER:tid} %{GREEDYDATA:errormessage}, client: %{IP:client}" ]
add_tag => ["nginx_err"]
}
}
```
This matches the first pattern, adds the tag but then fails on the second pattern and I end up with a `_grokparsefailure`. What's a good way to match and tag access/error logs correctly with GELF?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 15, 2016, 5:55am UTC](https://discuss.elastic.co/t/is-there-a-way-to-tag-for-different-grok-matches/52785/2 "2016-06-15T05:55:08Z")
Wrap all but the first grok filter in a conditional so that the subsequent ones are only tried if there hasn't been a match earlier.
```nohighlight
grok {
...
}
if "_grokparsefailure" in [tags] {
grok {
...
remove_tag => ["_grokparsefailure"]
}
}
```
---
### Author:  [@Josh\_Reichardt](https://discuss.elastic.co/u/Josh_Reichardt)
#### Post date: [June 15, 2016, 10:37pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-tag-for-different-grok-matches/52785/3 "2016-06-15T22:37:15Z")
Thank, I'll give this a try. Will this work for a scenario where I have many grok patterns to try and many different tags to apply?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 16, 2016, 6:17am UTC](https://discuss.elastic.co/t/is-there-a-way-to-tag-for-different-grok-matches/52785/4 "2016-06-16T06:17:17Z")
Sure, it'll work. Matching lots and lots of regexps against all messages is of course computationally expensive so you'll want to order your expressions wisely.
---
### Author:  [@Josh\_Reichardt](https://discuss.elastic.co/u/Josh_Reichardt)
#### Post date: [June 16, 2016, 7:06pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-tag-for-different-grok-matches/52785/5 "2016-06-16T19:06:24Z")
Makes sense. Thanks again.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:52am UTC](https://discuss.elastic.co/t/is-there-a-way-to-tag-for-different-grok-matches/52785/6 "2017-07-06T04:52:27Z")