# Making a grok filed optional in grok pattern

**URL:** <https://discuss.elastic.co/t/making-a-grok-filed-optional-in-grok-pattern/303159>\
**Category:** Logstash\
**Created:** [April 25, 2022, 12:41pm UTC](https://discuss.elastic.co/t/making-a-grok-filed-optional-in-grok-pattern/303159 "2022-04-25T12:41:07Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 25, 2022, 5:29pm UTC](https://discuss.elastic.co/t/making-a-grok-filed-optional-in-grok-pattern/303159/3 "2022-04-25T17:29:38Z")

</div>

> [@Pranjal\_Sett](#):
>
> [J2EE\_APP.name: soa-infra]

If that field is optional then you can use ? (zero or more) or {0,1} (zero or exactly one) to indicate that. The square brackets must be escaped to show that they are not part of a character group. Use parentheses to indicate what {0,1} applies to

```
(\[J2EE_APP.name: [-\w]+\]){0,1}

```

In some cases it is easier to [search for multiple patterns](https://discuss.elastic.co/t/parse-mcafee-audit-log-file-with-logstash/302946/2).

---

_[View the full topic](https://discuss.elastic.co/t/making-a-grok-filed-optional-in-grok-pattern/303159)._