# Logstash Grok pattern match issue
**URL:** https://discuss.elastic.co/t/logstash-grok-pattern-match-issue/282584
**Category:** Logstash
**Created:** [August 26, 2021, 2:22pm UTC](https://discuss.elastic.co/t/logstash-grok-pattern-match-issue/282584 "2021-08-26T14:22:39Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@ericilavia](https://discuss.elastic.co/u/ericilavia)
#### Post date: [August 26, 2021, 2:22pm UTC](https://discuss.elastic.co/t/logstash-grok-pattern-match-issue/282584/1 "2021-08-26T14:22:39Z")
Hello,
I am facing an issue with parsing data using Logstash using Grok filter, below is the use-case
There are two types of logs I am trying to parse,
//Grok patterns
**Type1:**
04-16 07:16:35,359[INFO]:Except:Processing Application - End for **AAAA11112021-04-16-07.16.24.545**
**Type2:**
04-16 12:29:30,044[INFO]:Except:Processing Application - End for **BBBB2222 002021-04-16-12.29.29.722**
If you notice both logs are identical, the only difference is for one the applicationId has a space and the other does not have a space
I have below two patterns defined for both types of logs
Grok pattern Type1 logs:
%{GREEDYDATA:logdate}[%{LOGLEVEL:loglevel}]:%{WORD:class}:%{WORD:log\_text\_1} %{WORD:log\_text\_2} - %{WORD:log\_text\_3} %{WORD:log\_text\_4} %{NOTSPACE:application\_id}
Grok pattern Type2 logs:
%{GREEDYDATA:logdate}[%{LOGLEVEL:loglevel}]:%{WORD:class}:%{WORD:log\_text\_1} %{WORD:log\_text\_2} - %{WORD:log\_text\_3} %{WORD:log\_text\_4} %{NOTSPACE:application\_id} %{NOTSPACE:timestamp}
The issue is that even for **Type2** logs the **Type1** **pattern** matches and I do not get the timestamp, how can I create Grok patterns that differentiate between these two logs?
Any help would be greatly appreciated. Thanks in advance
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 26, 2021, 3:39pm UTC](https://discuss.elastic.co/t/logstash-grok-pattern-match-issue/282584/2 "2021-08-26T15:39:19Z")
If you use a grok filter to match against an [array of patterns](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html#plugins-filters-grok-match) then they are processed in order. Just put the pattern with the space first.
---
### Author:  [@ericilavia](https://discuss.elastic.co/u/ericilavia)
#### Post date: [August 27, 2021, 9:16am UTC](https://discuss.elastic.co/t/logstash-grok-pattern-match-issue/282584/3 "2021-08-27T09:16:49Z")
Thank you that worked. How can we remove the grokparsefailures from our logs if we do not want them?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 27, 2021, 3:44pm UTC](https://discuss.elastic.co/t/logstash-grok-pattern-match-issue/282584/4 "2021-08-27T15:44:28Z")
If you want to delete events that have \_grokparsefailure then use
```
if "_grokparsefailure" in [tags] { drop {} }
```
If you do not want the tag added then use
```
tag_on_failure => []
```
on your grok filter.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 24, 2021, 3:44pm UTC](https://discuss.elastic.co/t/logstash-grok-pattern-match-issue/282584/5 "2021-09-24T15:44:55Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.