# Multiple matches in grok won't work

**URL:** <https://discuss.elastic.co/t/multiple-matches-in-grok-wont-work/153551>\
**Category:** Logstash\
**Created:** [October 23, 2018, 9:06am UTC](https://discuss.elastic.co/t/multiple-matches-in-grok-wont-work/153551 "2018-10-23T09:06:19Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![bab](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bab/32/86201_2.png) [@bab](https://discuss.elastic.co/u/bab)\
**Post date:** [October 23, 2018, 9:06am UTC](https://discuss.elastic.co/t/multiple-matches-in-grok-wont-work/153551/1 "2018-10-23T09:06:19Z")

</div>

Hi,  
my logs :

```
[9/16/18 19:00:22:154 CEST] 00001609 SystemOut O 2018-09-16 19:00:22,154 ERROR [ContentQueueWorker_ADR_Worker background task processing6064] - Failed to delete Centera clip id 840VGECLTS8FAe7GT8CKT6LF91AG41CHNC9VU204BR9L02LJTO2BD (Centera error code: -10005)
com.filepool.fplibrary.FPLibraryException: com.emc.vipr.cashead.api.InternalObjectException: Unable to set object metadata for: 840VGECLTS8FAe7GT8CKT6LF91AG41CHNC9VU204BR9L02LJTO2BD
	at com.emc.vipr.cashead.impl.vipr.ExceptionTranslator.translateError(ExceptionTranslator.java:40)
	at com.emc.vipr.cashead.impl.vipr.BlobClientObjectDatastore.setObjectMetadata(BlobClientObjectDatastore.java:321)
	at com.emc.vipr.cashead.storageserver.access.transaction.delete.UpdateMetadata.performAction(UpdateMetadata.java:32)
[9/16/18 19:00:22:154 CEST] 00001609 SystemOut O 1032332946 [ContentQueueWorker_ADR_Worker background task processing6064] ERROR filenet_error.fixed_content_provider.com.filenet.engine.content.fcprovider.centera.CenteraAdaptor - Failed to delete Centera clip id 840VGECLTS8FAe7GT8CKT6LF91AG41CHNC9VU204BR9L02LJTO2BD (Centera error code: -10005)
com.filepool.fplibrary.FPLibraryException: com.emc.vipr.cashead.api.InternalObjectException: Unable to set object metadata for: 840VGECLTS8FAe7GT8CKT6LF91AG41CHNC9VU204BR9L02LJTO2BD
	at com.emc.vipr.cashead.impl.vipr.ExceptionTranslator.translateError(ExceptionTranslator.java:40)
	at com.emc.vipr.cashead.impl.vipr.BlobClientObjectDatastore.setObjectMetadata(BlobClientObjectDatastore.java:321)
[9/17/18 12:30:11:507 CEST] 000016f7 SystemOut O 2018-09-17 12:30:11,507 WARN [CSEIndexProcessor$BatchExecutor_null_Worker background task processing7140] - No text was produced from the extraction process for /opt/filenet/collections_temp/sl008848/cpe1member01/OS{B0E9EAD3-6229-407F-AD9E-443B23620D16}/FN17/FN10/FN22/FN{4011E765-0000-CF12-AFA2-A450427591D0}{514DD4A4-6D3B-48B2-B400-CB2ECE734A75}-0.pdf object:{4011E765-0000-CF12-AFA2-A450427591D0} class:InvoicePaymentOrderBookingVoucher Reason: NO_TEXT_EXTRACTED
[7/30/18 4:25:27:036 CEST] 0000011e SetDateProper I de.abs.ecm.filenet.eventactions.SetDatePropertyOnVersionPromotion onPromoteVersionEvent Property SentOn an Dokument ID={20DCE864-0000-CB14-A6A5-2AC66640F647} auf den Wert 2018-07-30 04:25:26.933 gesetzt.
[7/30/18 9:32:54:708 CEST] 0000006f InheritDossie E de.abs.ecm.filenet.eventactions.InheritDossierPropertiesOnFiledIn inheritDossierProperties Bei der Ausführung einer EventAction ist ein Fehler aufgetreten: Das Dokument ID={806BC764-0200-C1AB-ACED-49213624A58B} liegt in mehr als einem Ordner vor, Zuweisung der Sicherheitseinstellungen nicht möglich
    java.lang.Runtime.
	at com.emc.vipr.cashead.impl.vipr.ExceptionTranslator.translateError(ExceptionTranslator.java:40)
	at com.emc.vipr.cashead.impl.vipr.BlobClientObjectDatastore.setObjectMetadata(BlobClientObjectDatastore.java:321)
[9/17/18 15:01:43:995 CEST] 0000176f InheritDossie I de.abs.ecm.filenet.eventactions.InheritDossierPropertyValues setProperty Property konnte nicht gesetzt werden, da nicht gefunden: AnualTurnOver

```

my logstash configuration:

```
input { beats {port => 5044 } }

filter {

# CPE JVM log pattern
 if [fields][log_type] == "SystemOut-CPE-JVM" {
 grok {
 break_on_match => false
 match => { "message" => "%{DATESTAMP:time} %{NOTSPACE} %{NOTSPACE:thread} %{WORD:log-source} []* %{WORD:sev} %{NOTSPACE} \[%{DATA}\] %{LOGLEVEL:log-level} %{GREEDYDATA:msg}" }
 match => { "message" => "%{DATESTAMP:time} %{NOTSPACE} %{NOTSPACE:thread} %{WORD:log-source} []* %{WORD:sev} %{TIMESTAMP_ISO8601} %{LOGLEVEL:log-level} %{GREEDYDATA:msg}" }
 match => { "message" => "%{DATESTAMP:time} %{NOTSPACE} %{NOTSPACE:thread} %{WORD:log-source} []* %{WORD:sev} %{TIMESTAMP_ISO8601} []* %{LOGLEVEL:log-level} %{GREEDYDATA:msg}" }
 match => { "message" => "%{DATESTAMP:time} %{NOTSPACE} %{NOTSPACE:thread} %{WORD:log-source} []* %{DATA:sev} %{NOTSPACE} %{GREEDYDATA:msg}" }
 match => { "message" => "%{DATESTAMP:time} %{NOTSPACE} %{NOTSPACE:thread} %{WORD:log-source} %{WORD:sev} %{NOTSPACE:package} %{WORD:methode} %{GREEDYDATA:msg}" }
  }
  mutate { replace => ["type", "SystemOut-CPE-JVM_log"] }
}

}
output {

stdout { codec => rubydebug }

  elasticsearch {
        hosts => ["localhost:9200"]
        index => "test_1"
}
}

```

the main problem is i'm not able to parse all above logs together, but it work fine when i parse the log-entries separately.  
I set up the `break_on_match` to false but still not working for all matches together.

any idea why it's not working, thanks in advance

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 20, 2018, 9:06am UTC](https://discuss.elastic.co/t/multiple-matches-in-grok-wont-work/153551/2 "2018-11-20T09:06:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.