# Matching multiple logs to differnt patterns

**URL:** <https://discuss.elastic.co/t/matching-multiple-logs-to-differnt-patterns/90495>\
**Category:** Logstash\
**Created:** [June 22, 2017, 3:54pm UTC](https://discuss.elastic.co/t/matching-multiple-logs-to-differnt-patterns/90495 "2017-06-22T15:54:10Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![cisaksen](https://avatars.discourse-cdn.com/v4/letter/c/49beb7/32.png) [@cisaksen](https://discuss.elastic.co/u/cisaksen)\
**Post date:** [June 22, 2017, 3:54pm UTC](https://discuss.elastic.co/t/matching-multiple-logs-to-differnt-patterns/90495/1 "2017-06-22T15:54:10Z")

</div>

I'm using filebeat to send log files from different servers to logstash. Srv1 has an index of nginx, while srv2 has it set to apache.

I have 2 patterns SED\_NGINX\_COMBINE(custom) and HTTPD\_COMBINELOG (builtin).

Not sure how or what is the best way to match these records as they are coming in.

tried :

> grok {  
> patterns\_dir =\> ["/etc/logstash/patterns"]  
> match =\> {  
> "message" =\> "%{SED\_NGINX\_COMBINE}"  
> "message" =\> "%{HTTPD\_COMBINELOG}"  
> }

but it didn't like this.

Just not sure how to go about this or should I create a second xxx.conf file for the different log files with a different index for Elasticsearch.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 22, 2017, 6:59pm UTC](https://discuss.elastic.co/t/matching-multiple-logs-to-differnt-patterns/90495/2 "2017-06-22T18:59:25Z")

</div>

The grok filter documentation contains an example of how to use multiple grok expressions in the same filter.

---

<div class="post-metadata">

**Author:** ![cisaksen](https://avatars.discourse-cdn.com/v4/letter/c/49beb7/32.png) [@cisaksen](https://discuss.elastic.co/u/cisaksen)\
**Post date:** [June 22, 2017, 7:27pm UTC](https://discuss.elastic.co/t/matching-multiple-logs-to-differnt-patterns/90495/3 "2017-06-22T19:27:15Z")

</div>

Thanks that was incredibility unhelpful !

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 26, 2017, 9:06pm UTC](https://discuss.elastic.co/t/matching-multiple-logs-to-differnt-patterns/90495/4 "2017-06-26T21:06:54Z")

</div>

Seriously, why wasn't that helpful? You're having syntax issues getting multiple grok expressions working in a single filter and I pointed you to where you could find examples of just that.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 24, 2017, 9:07pm UTC](https://discuss.elastic.co/t/matching-multiple-logs-to-differnt-patterns/90495/5 "2017-07-24T21:07:04Z")

</div>

Closed on July 24, 2017, 9:07pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.