# Logstash Grok break\_on\_filter not working

**URL:** <https://discuss.elastic.co/t/logstash-grok-break-on-filter-not-working/122077>\
**Category:** Logstash\
**Created:** [March 1, 2018, 1:32pm UTC](https://discuss.elastic.co/t/logstash-grok-break-on-filter-not-working/122077 "2018-03-01T13:32:01Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![vijs](https://avatars.discourse-cdn.com/v4/letter/v/e9a140/32.png) [@vijs](https://discuss.elastic.co/u/vijs)\
**Post date:** [March 1, 2018, 1:32pm UTC](https://discuss.elastic.co/t/logstash-grok-break-on-filter-not-working/122077/1 "2018-03-01T13:32:01Z")

</div>

Hi

My Logstructure is like this:

> * * *
> 
> ## Thu 11/09/17 15:05:44
> 
> ## 11-09-2017 03:40:53 - :: | Error: 3303 | Data1 | 123456 6489 Description1 11-09-2017 03:40:54 - :: | Error: 3303 | Data2 | 123456 6489 Description2 ....
> 
> ## Thu 11/09/17 15:41:30

where the initial info is error log start time and last info is error log end time

I have to parse them and display it as startdate:Thu 11/09/17 15:05:44 and enddate:Thu 11/09/17 15:41:30  
Also I want to stop the grok for matching the first line of log where it matches "Error: 3303 "

My config file is as below:

> input {...}  
> filter {  
> grok {  
> match =\> ["message", "=%{SPACE}%{DAY}%{SPACE}%{DATE}%{SPACE}%{TIME:time}%{SPACE}%{DATA}"]  
> add\_tag =\> ['dated']  
> }  
> grok {  
> match =\> ["message", "(\Error: 3303)"]  
> break\_on\_match =\> true  
> add\_tag =\> ["trace"]  
> }  
> }  
> output{...}

But break on match is not working for me it is dding tag to the next lines also.  
Also how to get the date as startdate and enddate.

Please help me with this

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 29, 2018, 1:32pm UTC](https://discuss.elastic.co/t/logstash-grok-break-on-filter-not-working/122077/2 "2018-03-29T13:32:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.