# Logstash Grok Filter patteren

**URL:** <https://discuss.elastic.co/t/logstash-grok-filter-patteren/136663>\
**Category:** Logstash\
**Created:** [June 20, 2018, 9:56am UTC](https://discuss.elastic.co/t/logstash-grok-filter-patteren/136663 "2018-06-20T09:56:34Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tek\_Chand](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tek_chand/32/34318_2.png) [@Tek\_Chand](https://discuss.elastic.co/u/Tek_Chand)\
**Post date:** [June 20, 2018, 9:56am UTC](https://discuss.elastic.co/t/logstash-grok-filter-patteren/136663/1 "2018-06-20T09:56:34Z")

</div>

Hi All,

I want to write Grok Filter for 100 Unique type of logs. Currently i have written for syslog and one log of our application. So i need to write 99 more grok filter. Can you please let me know how i can make it easy.

As per my knowledge i need to write 99 grok filter and need to append them with earlier 2 filter. But it is very complicated way...Please suggest some better way to complete my task.

Thanks in Advance.

Below is my current Grok Filter:

```
  filter {
   grok {
   match => { "message" => ["%{SYSLOGTIMESTAMP:syslog_timestamp %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}", "(?<loglevel>\w\,)\s\[(?<datetime>[\d\-\w\:\.\s\#]+)\]\s\s(?<loglevel2>[\w]+)\s\--\s\:\s\[(?<session-id>[\d\-\w]+)\]\s(?<message-brew>[\w\s\d\(\:\.\)]+)" ] }
}
}
```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 20, 2018, 2:06pm UTC](https://discuss.elastic.co/t/logstash-grok-filter-patteren/136663/2 "2018-06-20T14:06:49Z")

</div>

A single grok filter can list multiple expressions so you don't need 100 grok filters. See the example in the grok filter documentation.

If you don't want your configuration or logs to get garbled when posting here make sure you format it as preformatted text using Markdown notation or the `</>` toolbar button.

---

<div class="post-metadata">

**Author:** ![Tek\_Chand](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tek_chand/32/34318_2.png) [@Tek\_Chand](https://discuss.elastic.co/u/Tek_Chand)\
**Post date:** [June 20, 2018, 2:08pm UTC](https://discuss.elastic.co/t/logstash-grok-filter-patteren/136663/3 "2018-06-20T14:08:52Z")

</div>

Means, you are saying that i can continue as i have written 2 regex which are pasted above. I can continue with same procedure. Please confirm.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 20, 2018, 2:10pm UTC](https://discuss.elastic.co/t/logstash-grok-filter-patteren/136663/4 "2018-06-20T14:10:07Z")

</div>

Oh, right. Didn't spot that you actually have two expressions in that filter. Yeah, that's fine.

---

<div class="post-metadata">

**Author:** ![Tek\_Chand](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tek_chand/32/34318_2.png) [@Tek\_Chand](https://discuss.elastic.co/u/Tek_Chand)\
**Post date:** [June 20, 2018, 2:15pm UTC](https://discuss.elastic.co/t/logstash-grok-filter-patteren/136663/5 "2018-06-20T14:15:01Z")

</div>

But if i have 100 unique logs then it will be little bit lengthy procedure...Can we use any other method?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 20, 2018, 2:41pm UTC](https://discuss.elastic.co/t/logstash-grok-filter-patteren/136663/6 "2018-06-20T14:41:08Z")

</div>

Maybe, but without knowing what the logs look like it's impossible to tell.

---

<div class="post-metadata">

**Author:** ![Tek\_Chand](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tek_chand/32/34318_2.png) [@Tek\_Chand](https://discuss.elastic.co/u/Tek_Chand)\
**Post date:** [June 21, 2018, 5:26am UTC](https://discuss.elastic.co/t/logstash-grok-filter-patteren/136663/7 "2018-06-21T05:26:38Z")

</div>

Thank you Magnusbaeck. Once i have the logs from our developer team, i will provide some sample logs.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 19, 2018, 5:26am UTC](https://discuss.elastic.co/t/logstash-grok-filter-patteren/136663/8 "2018-07-19T05:26:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.