# Multi pattern grok failing to load

**URL:** <https://discuss.elastic.co/t/multi-pattern-grok-failing-to-load/76422>\
**Category:** Logstash\
**Created:** [February 24, 2017, 4:14pm UTC](https://discuss.elastic.co/t/multi-pattern-grok-failing-to-load/76422 "2017-02-24T16:14:48Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![mhooper](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@mhooper](https://discuss.elastic.co/u/mhooper)\
**Post date:** [February 24, 2017, 4:14pm UTC](https://discuss.elastic.co/t/multi-pattern-grok-failing-to-load/76422/1 "2017-02-24T16:14:48Z")

</div>

After I added the following grok pattern, my config fails to load.

> grok {  
> match =\> { "tempMessage" =\> "WebAPI - Request Uri: %{DATA:action} [http://webservice.bigcompany.com/%{WORD:endpoint}/%{INT:number}/%{WORD:cancel}\?reason](http://webservice.bigcompany.com/%25%7BWORD:endpoint%7D/%25%7BINT:number%7D/%25%7BWORD:cancel%7D%5C?reason)",  
> "WebAPI - Request Uri: %{DATA:action} [http://webservice.bigcompany.com/%{DATA:endpoint}/%{INT:number}](http://webservice.bigcompany.com/%25%7BDATA:endpoint%7D/%25%7BINT:number%7D)",  
> "WebAPI - Request Uri: %{DATA:action} [http://webservice.bigcompany.com/%{DATA:endpoint}/](http://webservice.bigcompany.com/%25%7BDATA:endpoint%7D/)" }  
> }

looking at examples on web I'm not sure what I've done wrong when adding multiple patterns.

thank you

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [February 26, 2017, 8:41am UTC](https://discuss.elastic.co/t/multi-pattern-grok-failing-to-load/76422/2 "2017-02-26T08:41:31Z")

</div>

Fail how?

---

<div class="post-metadata">

**Author:** ![mhooper](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@mhooper](https://discuss.elastic.co/u/mhooper)\
**Post date:** [February 26, 2017, 8:04pm UTC](https://discuss.elastic.co/t/multi-pattern-grok-failing-to-load/76422/3 "2017-02-26T20:04:07Z")

</div>

in log it says 'Failed to load" "invalid config". I remove this grok and it loads cleanly.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 28, 2017, 2:15pm UTC](https://discuss.elastic.co/t/multi-pattern-grok-failing-to-load/76422/4 "2017-02-28T14:15:59Z")

</div>

Your filter should look like this:

```nohighlight
grok {
  match => {
    "tempMessage" => [
      "WebAPI - Request Uri: %{DATA:action} http://webservice.bigcompany.com/%{WORD:endpoint}/%{INT:number}/%{WORD:cancel}\?reason",
      "WebAPI - Request Uri: %{DATA:action} http://webservice.bigcompany.com/%{DATA:endpoint}/%{INT:number}",
      "WebAPI - Request Uri: %{DATA:action} http://webservice.bigcompany.com/%{DATA:endpoint}/" 
    ]
  }
}

```

You could do the same thing with a single expression, by the way:

```
WebAPI - Request Uri: %{DATA:action} http://webservice.bigcompany.com/%{WORD:endpoint}((/%{INT:number})?/(%{WORD:cancel}\?reason)?)?
```

---

<div class="post-metadata">

**Author:** ![mhooper](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@mhooper](https://discuss.elastic.co/u/mhooper)\
**Post date:** [February 28, 2017, 3:08pm UTC](https://discuss.elastic.co/t/multi-pattern-grok-failing-to-load/76422/5 "2017-02-28T15:08:50Z")

</div>

Thank you for both answers.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 28, 2017, 3:08pm UTC](https://discuss.elastic.co/t/multi-pattern-grok-failing-to-load/76422/6 "2017-03-28T15:08:58Z")

</div>

Closed on March 28, 2017, 3:08pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.