# Multiple custom grok patterns not matching, but they successfully match alone?
**URL:** https://discuss.elastic.co/t/multiple-custom-grok-patterns-not-matching-but-they-successfully-match-alone/193175
**Category:** Logs
**Created:** [July 31, 2019, 4:18pm UTC](https://discuss.elastic.co/t/multiple-custom-grok-patterns-not-matching-but-they-successfully-match-alone/193175 "2019-07-31T16:18:09Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@kmiklas](https://discuss.elastic.co/u/kmiklas)
#### Post date: [July 31, 2019, 4:18pm UTC](https://discuss.elastic.co/t/multiple-custom-grok-patterns-not-matching-but-they-successfully-match-alone/193175/1 "2019-07-31T16:18:09Z")
Grok matches single custom patterns, but does match when custom patterns are combined.
**Complete, working, an verifiable example**
Sample data:
```
OK 05/20 20:12:10:067 ABC_02~~DE_02 FGH_IJK jsmith _A0011
```
Custom patterns:
```
MMDD [0-1][0-9]/[0-3][0-9]
THREAD _W\w+
```
They work separately; specifically, this pattern works by itself:
```
%{MMDD:mmdd}
// Result
{
"mmdd": [
[
"05/20"
]
]
}
```
... and this pattern works by itself:
```
%{THREAD:thread}
// Result
{
"thread": [
[
"_A0011"
]
]
}
```
..but together, they fail:
```
%{MMDD:mmdd} %{THREAD:keyword}
No Matches
```
Puzzling. Tyvm Keith :^)
Note that I tried the solution presented in this post, but to no avail:
> [@Kibana Grok Debugger Multiple Custom Patterns](https://discuss.elastic.co/t/kibana-grok-debugger-multiple-custom-patterns/106708/3):
>
> Hi Lukas. Currently all I am trying to do is to put more than one custom grok pattern in the debugger. But for the purpose of resolving this issue I will provide you with a screenshot of what I have so far. So as you can see above I have used a custom grok pattern to match the 'Host' section of the log. Below is what I would like to achieve, however I believe my syntax is incorrect in the 'Custom Grok Patterns' section. cheers, G
Also testing here:
[https://grokdebug.herokuapp.com/](https://grokdebug.herokuapp.com/)
Regex Resource:
> **[regex101: build, test, and debug regex](https://regex101.com/)**
>
> Regular expression tester with syntax highlighting, explanation, cheat sheet for PHP/PCRE, Python, GO, JavaScript, Java, C#/.NET, Rust.
---
### Author:  [@John\_Schulz](https://discuss.elastic.co/u/John_Schulz)
#### Post date: [August 5, 2019, 5:51pm UTC](https://discuss.elastic.co/t/multiple-custom-grok-patterns-not-matching-but-they-successfully-match-alone/193175/2 "2019-08-05T17:51:59Z")
Hello, Keith,
Thanks for providing the sample data & regexes. That's very helpful.
**TL;DR** try something like `%{MMDD:mmdd}.+%{THREAD:keyword}` with these patterns
```auto
MMDD [0-1][0-9]/[0-3][0-9]
THREAD _\w+
```
_note_: I think the `THREAD` regex had an extra character and should should be `THREAD _\w+` instead of `THREAD _W\w+`
The reason they worked individually but not together is because `%{MMDD:mmdd} %{THREAD:keyword}` translates to "find MMDD regex, _followed by a single space character_ , followed by the THREAD regex"
Look at the results if we change the input to something like that (date SPACE id)
If we change the regex to account for the other characters which might be in between, it works as expected
`%{MMDD:mmdd}.+%{THREAD:keyword}` is "MMDD, then any number of any character (except newline), then THREAD".
There are options besides `.+` to put in between, but you'll need something besides a single literal space character.
I hope that helps. Please let us know if we can help further.
---
### Author:  [@kmiklas](https://discuss.elastic.co/u/kmiklas)
#### Post date: [August 6, 2019, 1:28pm UTC](https://discuss.elastic.co/t/multiple-custom-grok-patterns-not-matching-but-they-successfully-match-alone/193175/3 "2019-08-06T13:28:20Z")
Thanks for response, John.
I'm seasoned Dev, but a n00b to Grok.
I was under the impression that each space-separated grok filter was a separate little regex expression, and that the entire line was separately scanned for each.
Thanks for setting me straight.
Sincerely,
Keith
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 3, 2019, 1:38pm UTC](https://discuss.elastic.co/t/multiple-custom-grok-patterns-not-matching-but-they-successfully-match-alone/193175/4 "2019-09-03T13:38:54Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.