# Multiple pattern matching

**URL:** <https://discuss.elastic.co/t/multiple-pattern-matching/96221>\
**Category:** Logstash\
**Created:** [August 8, 2017, 8:23am UTC](https://discuss.elastic.co/t/multiple-pattern-matching/96221 "2017-08-08T08:23:48Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![DFrant](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dfrant/32/20512_2.png) [@DFrant](https://discuss.elastic.co/u/DFrant)\
**Post date:** [August 8, 2017, 8:23am UTC](https://discuss.elastic.co/t/multiple-pattern-matching/96221/1 "2017-08-08T08:23:48Z")

</div>

Hello, I have a filter defined as follow:

```
            grok {
                    patterns_dir => ["/etc/logstash/conf.d/patterns/"]
                    match =>
                            [
				"message", "^%{TIMESTAMP_ISO8601:logdate} INFO \[XML\] (ID) : %{NN_UTILISATEUR:nn_utilisateur} CERTIFICATE : %{DATA:certificate}$",
                                "message", "^%{TIMESTAMP_ISO8601:logdate} INFO \[XML\] %{NN_UTILISATEUR:nn_utilisateur} %{STATUS:status} (xml) : %{TX_HEADER}<%{TX_TYPE:tx_type}%{DATA}>%{DATA:tx_content}</%{TX_TYPE}>$"
                            ]
            }

```

I have checked both of them on [a grok tester](http://grokconstructor.appspot.com/) and they match perfectly. But I don't have any results with the first one when I run the server. Is there something that I missed/didn't do correctly?

Thanks

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 9, 2017, 6:18am UTC](https://discuss.elastic.co/t/multiple-pattern-matching/96221/2 "2017-08-09T06:18:46Z")

</div>

Without seeing example data the only thing I can say is that I suspect that `(ID)` should really be `\(ID\)`.

---

<div class="post-metadata">

**Author:** ![DFrant](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dfrant/32/20512_2.png) [@DFrant](https://discuss.elastic.co/u/DFrant)\
**Post date:** [August 9, 2017, 7:34am UTC](https://discuss.elastic.co/t/multiple-pattern-matching/96221/3 "2017-08-09T07:34:21Z")

</div>

Actually no, cause when I comment the second pattern, data corresponding to the first pattern are recorded..

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 9, 2017, 8:04am UTC](https://discuss.elastic.co/t/multiple-pattern-matching/96221/4 "2017-08-09T08:04:43Z")

</div>

Hmm. Maybe your attempt at matching multiple expressions against the same field uses the wrong syntax then. The documentation contains an example of the supported syntax.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 6, 2017, 8:04am UTC](https://discuss.elastic.co/t/multiple-pattern-matching/96221/5 "2017-09-06T08:04:47Z")

</div>

Closed on September 6, 2017, 8:04am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.