# Logstash/grok to match only first occurrence and stop parsing repeatedly for same values

**URL:** https://discuss.elastic.co/t/logstash-grok-to-match-only-first-occurrence-and-stop-parsing-repeatedly-for-same-values/274201
**Category:** Logstash
**Created:** [May 27, 2021, 11:41am UTC](https://discuss.elastic.co/t/logstash-grok-to-match-only-first-occurrence-and-stop-parsing-repeatedly-for-same-values/274201 "2021-05-27T11:41:22Z")
**Posts on this page:** 1
**Showing post:** 3

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 27, 2021, 7:17pm UTC](https://discuss.elastic.co/t/logstash-grok-to-match-only-first-occurrence-and-stop-parsing-repeatedly-for-same-values/274201/3 "2021-05-27T19:17:57Z")

</div>

> [@theirfan](#):
>
> The problem I have is that I want logstash/from to match only the first occurrence of "temperature 20" and "temperature 21" and drop/ignore the messages which have repeatedly same values.

If that is really what you want (one document for each value of temperature) then use the temperature as the document\_id (assuming you are sending data to elasticsearch). If you are not using elasticsearch you could do it in a ruby filter using something like

```
ruby {
    init => '@seenValues = {}'
    code => '
        value = event.get("someField")
        if @seenValues.include? (value)
            event.cancel
        end
        @seenValues[value] = 1
    '
}

```

If you only want events where that field changes then it can also be done using ruby. Something like

```
ruby {
    init => '@lastValue = ""'
    code => '
        value = event.get("someField")
        if value == @lastValue
            event.cancel
        end
        @lastValue = value
    '
}

```

In either case you will need pipeline.workers set to 1 and pipeline.ordered set to auto (the default in v7.x).

---

_[View the full topic](https://discuss.elastic.co/t/logstash-grok-to-match-only-first-occurrence-and-stop-parsing-repeatedly-for-same-values/274201)._