# Logstash filter file don't work
**URL:** https://discuss.elastic.co/t/logstash-filter-file-dont-work/104789
**Category:** Logstash
**Created:** [October 22, 2017, 5:28am UTC](https://discuss.elastic.co/t/logstash-filter-file-dont-work/104789 "2017-10-22T05:28:57Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@abu.sayeed](https://discuss.elastic.co/u/abu.sayeed)
#### Post date: [October 22, 2017, 5:28am UTC](https://discuss.elastic.co/t/logstash-filter-file-dont-work/104789/1 "2017-10-22T05:28:57Z")
My\_logstash\_filter.conf file
filter {
grok {
match =\> [
"message", "(?[A-Z\_A-Z\_A-Z]{10,14})",
"message", "(?[A-Z:A-Z:A-Z]{10,14})",
"message", "(?[A-Z]{4})" ]
}
}
These three fields never display at a time for every message. Any one of them show and other two of them are hide.
**Status**** Operator ****Logleve** l
**SENT**** -- ****--**
**--**** GP ****--**
**--**** -- ****INFO**
But I need like this:
**Status**** Operator ****Loglevel**
SENT Blink WARN
FAIL GP INFO
ERROR GP INFO
but not show status field.
my all status will be (10~14)characters of these
"GW\_IGNORED
GW\_IN\_PROGRESS
GW\_PENDING
GW\_UNREACHABLE
TELCO\_ERROR
TELCO\_SENT"
How can I add status filed in my Logstash filters Grok?
Thanks
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 23, 2017, 6:13am UTC](https://discuss.elastic.co/t/logstash-filter-file-dont-work/104789/2 "2017-10-23T06:13:22Z")
> My\_logstash\_filter.conf file
No, that's not what your file look like. The `` after the question mark is missing. **Always post your configuration files as preformatted text by using the `` toolbar button.**
> These three fields never display at a time for every message. Any one of them show and other two of them are hide.
That's expected. The grok filter stops processing remaining expressions once it gets a match.
Can't you use a single grok expression to catch all fields? What does an example line from the log look like.
---
### Author:  [@abu.sayeed](https://discuss.elastic.co/u/abu.sayeed)
#### Post date: [October 24, 2017, 5:05am UTC](https://discuss.elastic.co/t/logstash-filter-file-dont-work/104789/3 "2017-10-24T05:05:53Z")
filter {
grok {
match =\> [
"message", "(?``[A-Z]{4})",
"message", "(?``[,A-Za-z]{2,6})",
"message", "(?``[A-Z\_A-Z\_A-Z]{10,14})",
"message", "(?``[A-Z:A-Z:A-Z]{10,14})" ]
}
}
but not show all fields. Just always show one only field.
Thanks for helping me sir
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 24, 2017, 5:13am UTC](https://discuss.elastic.co/t/logstash-filter-file-dont-work/104789/4 "2017-10-24T05:13:14Z")
If there's anything in my answer you didn't understand just ask for a clarification. Repeating what you've already said isn't useful.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 21, 2017, 5:13am UTC](https://discuss.elastic.co/t/logstash-filter-file-dont-work/104789/5 "2017-11-21T05:13:31Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.