# Multiple grok match not working

**URL:** <https://discuss.elastic.co/t/multiple-grok-match-not-working/47748>\
**Category:** Logstash\
**Created:** [April 19, 2016, 6:12am UTC](https://discuss.elastic.co/t/multiple-grok-match-not-working/47748 "2016-04-19T06:12:57Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![komail](https://avatars.discourse-cdn.com/v4/letter/k/34f0e0/32.png) [@komail](https://discuss.elastic.co/u/komail)\
**Post date:** [April 19, 2016, 6:12am UTC](https://discuss.elastic.co/t/multiple-grok-match-not-working/47748/1 "2016-04-19T06:12:57Z")

</div>

I have two kinds of logs as shown below in my log file, which I need to match

```
 -- url: /display/wDocs/com.abc.downloadmanager+v1.1 | userName: komail badami | referer: https://abcd.com/display/wDocs/com.abc.downloadmanager+v1.1

 -- url: /pages/viewpage.action | userName: komail badami | referer: https://abcd.com/pages/viewpage.action?pageId=109851237

```

So, I wrote a grok multiple match construct as follows

```
filter {
    grok {
        patterns_dir => "./patterns"
        break_on_match => false
        match => { "message" => ["-- url: \/%{DATA:url1}\/%{DATA:url2}\/%{DATA:url3}%{GREEDYDATA:pageName}[;]\|[;]userName:[;]%{GREEDYDATA:userName}[;]\|[;]",
         "-- url: \/pages\/viewpage.action[;]\|[;]userName:[;]%{GREEDYDATA:userName}[;]\|[;]referer:[;]%{URIPROTO:uriProto}://%{HOSTNAME:host}/%{WORD:h1}/%{WORD:h2 }/%{GREEDYDATA:pageName}"]}
}

if "_grokparsefailure" in [tags] {
     drop {}
  }

if "v1" not in [pageName] and "v2" not in [pageName] and "v3" not in [pageName] {
       drop {}
      }
}

```

I need to get the pageName, userName from these logs for all the log entries which have a version field in them and which match the grok filters. But it doesn't seem to work. What am I doing wrong here ?

Note: Using the first grok pattern only works well, but I need to have both to be checked. I've tested the patterns individually on Grok Debugger and it works.

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 19, 2016, 8:26am UTC](https://discuss.elastic.co/t/multiple-grok-match-not-working/47748/2 "2016-04-19T08:26:11Z")

</div>

First of all, drop the `break_on_match` setting. Here's the problematic part of your second expression:

```
%{URIPROTO:uriProto}://%{HOSTNAME:host}/%{WORD:h1}/%{WORD:h2 }/%{GREEDYDATA:pageName}

```

Things break at the "h2" token since there's no directory component after "pages". You're trying to match one more directory level than you have in the input.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:01am UTC](https://discuss.elastic.co/t/multiple-grok-match-not-working/47748/3 "2017-07-06T05:01:40Z")

</div>