# Multiple Grok patterns help

**URL:** <https://discuss.elastic.co/t/multiple-grok-patterns-help/282965>\
**Category:** Logstash\
**Created:** [August 31, 2021, 10:15pm UTC](https://discuss.elastic.co/t/multiple-grok-patterns-help/282965 "2021-08-31T22:15:06Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 31, 2021, 11:54pm UTC](https://discuss.elastic.co/t/multiple-grok-patterns-help/282965/2 "2021-08-31T23:54:49Z")

</div>

> [@Zorkmid](#):
>
> Is the following the correct?

No. You need to match the most specific pattern first, then get gradually less specific. In your case the first pattern will match every time.

I suggest you also read through [this](https://discuss.elastic.co/t/grok-increase-cpu-usage-to-700/256633/2) post, since you can probably greatly speed up that configuration.

---

_[View the full topic](https://discuss.elastic.co/t/multiple-grok-patterns-help/282965)._