[\w\s\:]+)" ] }
```
Any suggestion will be appreciated.
Thanks in advance.
---
### Author:  [@Shaoranlaos](https://discuss.elastic.co/u/Shaoranlaos)
#### Post date: [July 30, 2018, 12:35pm UTC](https://discuss.elastic.co/t/multile-pattren-in-single-grok-filter/142168/2 "2018-07-30T12:35:28Z")
could you post some sample lines?
Not sure if i read it correctly but are these pattern for different log lines or each for the same and they extract different fields?
if these filters should all be executed for the same log line you will need to disable the break\_on\_match option of the grok filter:
[https://www.elastic.co/guide/en/logstash/6.2/plugins-filters-grok.html#plugins-filters-grok-break\_on\_match](https://www.elastic.co/guide/en/logstash/6.2/plugins-filters-grok.html#plugins-filters-grok-break_on_match)
---
### Author:  [@Tek\_Chand](https://discuss.elastic.co/u/Tek_Chand)
#### Post date: [July 31, 2018, 3:49am UTC](https://discuss.elastic.co/t/multile-pattren-in-single-grok-filter/142168/3 "2018-07-31T03:49:54Z")
Hello Shaoranlaos,
Above patterns are for different log lines. But some filelds are common in all logs. So my patterns are look generic. Please find the some sample logs:
```auto
I, [2018-07-23T08:49:09.854771 #22418] INFO -- : [81ee6e72-e1b3-4480-b664-0e215cdf23a8] Started POST "/api/v1/locations.json" for 127.0.0.1 at 2018-07-23 08:49:09 +0000
I, [2018-07-23T08:49:09.856826 #22418] INFO -- : [81ee6e72-e1b3-4480-b664-0e215cdf23a8] Processing by Api::V1::LocationsController#create as JSON
I, [2018-07-23T08:49:09.860378 #22418] INFO -- : [81ee6e72-e1b3-4480-b664-0e215cdf23a8] Current device: 1380 : 001
I, [2018-07-23T08:49:09.861850 #22418] INFO -- : [81ee6e72-e1b3-4480-b664-0e215cdf23a8] Device :: 1380 :: 5
```
Please help to fix this issue or let me know if i need to made any changes in my patterns.
Thanks.
---
### Author:  [@Shaoranlaos](https://discuss.elastic.co/u/Shaoranlaos)
#### Post date: [July 31, 2018, 5:07am UTC](https://discuss.elastic.co/t/multile-pattren-in-single-grok-filter/142168/4 "2018-07-31T05:07:02Z")
in my tries it is the second pattern that will always match and not the first (because your log lines are not syslogs)
anyway could you try to change the order of the patterns and be more specific in the matching because all 3 pattern match the provided lines and extract because of this for the specific fields nonsense
it needs some identifing word or character to correctly differentiate between the patterns
for this you also could try to only use the general pattern (where only message is extracted, second pattern in your starting post) and then make the specific field extraction in an extra grok filter on the message field(would probaly reduce some overhead and maintenance cost).
e.g. (like i think it will make sense)
```auto
match => { "message" => ["%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}",
"\I\,\s\[(?[\d\-\w\:\.]+)\s\#(?[\d]+)\]\s\s(?[\w]+)\s\--\s\:\s\[(?[\d\-\w]+)\]\sStarted\s%{WORD:verb}\s\"(?[\w\s\"\/\.]+)\"\s(?.*)",
"\I\,\s\[(?[\d\-\w\:\.]+)\s\#(?[\d]+)\]\s\s(?[\w]+)\s\--\s\:\s\[(?[\d\-\w]+)\]\s(?:Current\s)?[dD]evice[\s:]+(?[\w\s\:]+)",
"\I\,\s\[(?[\d\-\w\:\.]+)\s\#(?[\d]+)\]\s\s(?[\w]+)\s\--\s\:\s\[(?[\d\-\w]+)\]\s(?.*)" ] }
```
this is only a quick shoot from my side i will see if i find the time today to take a closer look
---
### Author:  [@Tek\_Chand](https://discuss.elastic.co/u/Tek_Chand)
#### Post date: [July 31, 2018, 5:30am UTC](https://discuss.elastic.co/t/multile-pattren-in-single-grok-filter/142168/5 "2018-07-31T05:30:36Z")
Hello Shaoranlaos,
Thank you for your help. You are right that was my second pattern which match my logs. I wil also look into your approach and try to be more specific.
Thanks once again.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 28, 2018, 5:30am UTC](https://discuss.elastic.co/t/multile-pattren-in-single-grok-filter/142168/6 "2018-08-28T05:30:42Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.