# Multiple pattern matching log file

**URL:** https://discuss.elastic.co/t/multiple-pattern-matching-log-file/56008
**Category:** Logstash
**Created:** [July 20, 2016, 5:24pm UTC](https://discuss.elastic.co/t/multiple-pattern-matching-log-file/56008 "2016-07-20T17:24:50Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![bishaka](https://avatars.discourse-cdn.com/v4/letter/b/e480ec/32.png) [@bishaka](https://discuss.elastic.co/u/bishaka)
#### Post date: [July 20, 2016, 5:24pm UTC](https://discuss.elastic.co/t/multiple-pattern-matching-log-file/56008/1 "2016-07-20T17:24:50Z")

</div>

Hi,  
So my log file contains multiple patterns (2 diff types) so i made 2 different match patterns to accompany both of them. Everythings working fine and I don't get \_grokparsefailure tags errors. However.. it is returning 2 different values for the same field (which makes sense). Now what I want to do is keep the ones I need and get rid of the ones I do not. How can I do that?

As you can see in the picture below, requestStatus, requestType and requestDetails all returning 2 different values.

My logstash file:  
filter {  
grok {  
tag\_on\_failure =\> ["BROKEN\_GROK\_SYSLOG", "\_grokparsefailure"]  
overwrite =\> ["message"]  
match =\> ["message", "%{NOTSPACE} %{NOTSPACE:threadType} %{NOTSPACE} %{NOTSPACE} %{NOTSPACE} %{NOTSPACE} %{NOTSPACE} %{NOTSPACE} %{NOTSPACE} %{NOTSPACE:requestType} %{NOTSPACE} %{NOTSPACE:requestStatus} %{NOTSPACE} %{GREEDYDATA:requestDetails}"]

```
}
grok {
	tag_on_failure => ["BROKEN_GROK_SYSLOG", "_grokparsefailure"]
	overwrite => ["message"]
    match => ["message", "%{NOTSPACE} %{NOTSPACE} %{NOTSPACE} %{NOTSPACE:requestType} %{NOTSPACE} %{NOTSPACE:requestStatus} %{NOTSPACE} %{GREEDYDATA:requestDetails}"]

	}
mutate {
    remove => ["message"]
}

geoip {
  source => "clientip"
  target => "geoip"
  database => "/etc/logstash/GeoLiteCity.dat"
  add_field => ["[geoip][coordinates]", "%{[geoip][longitude]}" ]
  add_field => ["[geoip][coordinates]", "%{[geoip][latitude]}" ]
}
mutate {
  convert => ["[geoip][coordinates]", "float"]
}

```

}

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [July 21, 2016, 11:30am UTC](https://discuss.elastic.co/t/multiple-pattern-matching-log-file/56008/2 "2016-07-21T11:30:53Z")

</div>

Please don't post pictures of text, they are difficult to read and some people may not be even able to see them.

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 21, 2016, 6:31pm UTC](https://discuss.elastic.co/t/multiple-pattern-matching-log-file/56008/3 "2016-07-21T18:31:54Z")

</div>

Why are you capturing different strings into the same `requestType` field in the first place? If you don't do that you won't have to clean up the field afterwards.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:46am UTC](https://discuss.elastic.co/t/multiple-pattern-matching-log-file/56008/4 "2017-07-06T04:46:56Z")

</div>