# Logstash/grok to match only first occurrence and stop parsing repeatedly for same values

**URL:** <https://discuss.elastic.co/t/logstash-grok-to-match-only-first-occurrence-and-stop-parsing-repeatedly-for-same-values/274201>\
**Category:** Logstash\
**Created:** [May 27, 2021, 11:41am UTC](https://discuss.elastic.co/t/logstash-grok-to-match-only-first-occurrence-and-stop-parsing-repeatedly-for-same-values/274201 "2021-05-27T11:41:22Z")\
**Posts on this page:** 5\
**Page:** 2

<div class="post-metadata">

**Author:** ![theirfan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theirfan/32/89339_2.png) [@theirfan](https://discuss.elastic.co/u/theirfan)\
**Post date:** [June 4, 2021, 9:52am UTC](https://discuss.elastic.co/t/logstash-grok-to-match-only-first-occurrence-and-stop-parsing-repeatedly-for-same-values/274201/22 "2021-06-04T09:52:03Z")

</div>

7.8.0

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 4, 2021, 3:55pm UTC](https://discuss.elastic.co/t/logstash-grok-to-match-only-first-occurrence-and-stop-parsing-repeatedly-for-same-values/274201/23 "2021-06-04T15:55:25Z")

</div>

[Upgrade](https://discuss.elastic.co/t/new-way-in-which-java-execution-breaks-the-aggregate-filter/239377) at least to 7.9.1, or disable the java execution engine.

---

<div class="post-metadata">

**Author:** ![theirfan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theirfan/32/89339_2.png) [@theirfan](https://discuss.elastic.co/u/theirfan)\
**Post date:** [June 5, 2021, 8:23pm UTC](https://discuss.elastic.co/t/logstash-grok-to-match-only-first-occurrence-and-stop-parsing-repeatedly-for-same-values/274201/24 "2021-06-05T20:23:10Z")

</div>

Tried with the latest 7.13.1. Still same.

---

<div class="post-metadata">

**Author:** ![theirfan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theirfan/32/89339_2.png) [@theirfan](https://discuss.elastic.co/u/theirfan)\
**Post date:** [June 7, 2021, 12:10pm UTC](https://discuss.elastic.co/t/logstash-grok-to-match-only-first-occurrence-and-stop-parsing-repeatedly-for-same-values/274201/25 "2021-06-07T12:10:28Z")

</div>

hi @Badger

I am trying for another way on this. Instead of using ruby at logstash, we can try to push for painless script to calculate us the durations from kibana.

What do you think?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2021, 12:11pm UTC](https://discuss.elastic.co/t/logstash-grok-to-match-only-first-occurrence-and-stop-parsing-repeatedly-for-same-values/274201/26 "2021-07-05T12:11:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

[Previous page](https://discuss.elastic.co/t/logstash-grok-to-match-only-first-occurrence-and-stop-parsing-repeatedly-for-same-values/274201.md?page=1)