I have a question about several matches in grok filter. Am I right to assume that with multiple matches, even if the log will be parsed successfully by one of them, it will still be _grokparsefailure in tags, cause of mismatch with the other match expressions?

To avoid misunderstandings, please use examples as much as possible instead of describing things in words. Are you talking about a single grok filter with multiple expressions? grok { match => { "message" => ["expr1", "expr2", ..., "exprN"] } } In this case you'll only get a _grokparsefail…

Discuss the Elastic Stack

Multiple match option in grok

Elastic Stack Logstash

Darya_Semenova (Darya Semenova) April 26, 2017, 12:01pm 8

Yeah, everything works now, thanks. It was another software that stood in the way.

Topic		Replies	Views
GROK Multiple Match - Logstash Logstash	4	27158	July 6, 2017
Grok multiple matches reports failures in an unexpected way Logstash	5	318	August 6, 2019
2 different logs match the filter, but only one is not parsed Logstash	5	869	August 13, 2019
Grok filter sequence Logstash	2	1137	April 21, 2017
_grokparsefailure Tag in all parsed logs with multiple grok filter Logstash	6	1552	September 30, 2020

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Multiple match option in grok

Related topics