# Logstash grok ignore field if unavailable

**URL:** https://discuss.elastic.co/t/logstash-grok-ignore-field-if-unavailable/229159
**Category:** Logstash
**Created:** [April 22, 2020, 2:13am UTC](https://discuss.elastic.co/t/logstash-grok-ignore-field-if-unavailable/229159 "2020-04-22T02:13:58Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Chandra12](https://avatars.discourse-cdn.com/v4/letter/c/9d8465/32.png) [@Chandra12](https://discuss.elastic.co/u/Chandra12)
#### Post date: [April 22, 2020, 2:13am UTC](https://discuss.elastic.co/t/logstash-grok-ignore-field-if-unavailable/229159/1 "2020-04-22T02:13:59Z")

</div>

Hi,  
I'm trying to skip field if any of below field is missing I couldn't to parse  
VD=73,IP=10.4.1.1,M1=1586,M2=158,TB=Mobile,

Grok expression for above

VD=%{NUMBER:VD},IP=%{IPV4:ipaddress},M1=%{NUMBER:m1},M2=%{NUMBER:m2},TB=%{DATA:tt},

Lets Say If VD is missing It has to parse by skipping field, I looking for universal pattern that parses even if any field is missing .

Any idea would be helpful thank you

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 22, 2020, 3:38pm UTC](https://discuss.elastic.co/t/logstash-grok-ignore-field-if-unavailable/229159/2 "2020-04-22T15:38:37Z")

</div>

What would the line look like if a field were missing? You can make a field optional by surrounding it with ()?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 20, 2020, 3:38pm UTC](https://discuss.elastic.co/t/logstash-grok-ignore-field-if-unavailable/229159/3 "2020-05-20T15:38:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
