# Multiple patterns in grok filter

**URL:** https://discuss.elastic.co/t/multiple-patterns-in-grok-filter/153106
**Category:** Logstash
**Created:** [October 19, 2018, 5:46am UTC](https://discuss.elastic.co/t/multiple-patterns-in-grok-filter/153106 "2018-10-19T05:46:43Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Billz1026](https://avatars.discourse-cdn.com/v4/letter/b/67e7ee/32.png) [@Billz1026](https://discuss.elastic.co/u/Billz1026)
#### Post date: [October 19, 2018, 5:46am UTC](https://discuss.elastic.co/t/multiple-patterns-in-grok-filter/153106/1 "2018-10-19T05:46:44Z")

</div>

Hi,

I have written following grok filter to match multiple log formats.

filter {  
grok {  
match =\> {  
"message" =\> "%{MONTH:Month}%{SPACE}%{NUMBER:Day} %{TIME:Time} %{IP:Host} %{NUMBER:SEQ\_NO}: %{DATA:Month\_From\_Device}%{SPACE}%{NUMBER:Day\_From\_Device} %{TIME:Time\_From\_Device}: %%{DATA:Facility}-%{DATA:Severity}-%{DATA:Event}: Login Success [user: %{NUMBER:Service\_Number}] [Source: %{IP:Log\_in\_Source}] %{GREEDYDATA:Information}","%{MONTH:Month}%{SPACE}%{NUMBER:Day} %{TIME:Time} %{IP:Host} %{NUMBER:SEQ\_NO}: %{DATA:Month\_From\_Device}%{SPACE}%{NUMBER:Day\_From\_Device} %{TIME:Time\_From\_Device}: %%{DATA:Facility}-%{DATA:Severity}-%{DATA:Event}: Login failed [user: %{NUMBER:Service\_Number}] [Source: %{IP:Log\_in\_Source}] %{GREEDYDATA:Information}", "%{MONTH:Month}%{SPACE}%{NUMBER:Day} %{TIME:Time} %{IP:Host} %{NUMBER:SEQ\_NO}: %{DATA:Month\_From\_Device}%{SPACE}%{NUMBER:Day\_From\_Device} %{TIME:Time\_From\_Device}: %%{DATA:Facility}-%{DATA:Severity}-%{DATA:Event}: %{GREEDYDATA:Information}", "%{MONTH:Month}%{SPACE}%{NUMBER:Day} %{TIME:Time} %{IP:Host} %{NUMBER:SEQ\_NO}: %{GREEDYDATA:Information}"  
}  
}  
}

but it gives following error when testing config.

[FATAL] 2018-10-19 11:05:10.035 [LogStash::Runner] runner - The given configuration is invalid. Reason: Expected one of #, {, } at line 12, column 335 (byte 460) after filter {.....

Please help to resolve this matter.

thanks in advance

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [October 19, 2018, 5:49am UTC](https://discuss.elastic.co/t/multiple-patterns-in-grok-filter/153106/2 "2018-10-19T05:49:23Z")

</div>

You need to specify the list of grok patterns within square brackets. There is [an example in the documentation](https://www.elastic.co/guide/en/logstash/6.4/plugins-filters-grok.html#plugins-filters-grok-match) on how to do this.

---

<div class="post-metadata">

### Author: ![Billz1026](https://avatars.discourse-cdn.com/v4/letter/b/67e7ee/32.png) [@Billz1026](https://discuss.elastic.co/u/Billz1026)
#### Post date: [October 19, 2018, 5:54am UTC](https://discuss.elastic.co/t/multiple-patterns-in-grok-filter/153106/3 "2018-10-19T05:54:17Z")

</div>

I change the filter as below. but error is coming yet.

filter {  
grok {  
match =\> {  
"message" =\> "[%{MONTH:Month}%{SPACE}%{NUMBER:Day} %{TIME:Time} %{IP:Host} %{NUMBER:SEQ\_NO}: %{DATA:Month\_From\_Device}%{SPACE}%{NUMBER:Day\_From\_Device} %{TIME:Time\_From\_Device}: %%{DATA:Facility}-%{DATA:Severity}-%{DATA:Event}: Login Success [user: %{NUMBER:Service\_Number}] [Source: %{IP:Log\_in\_Source}] %{GREEDYDATA:Information}"], "%{MONTH:Month}%{SPACE}%{NUMBER:Day} %{TIME:Time} %{IP:Host} %{NUMBER:SEQ\_NO}: %{DATA:Month\_From\_Device}%{SPACE}%{NUMBER:Day\_From\_Device} %{TIME:Time\_From\_Device}: %%{DATA:Facility}-%{DATA:Severity}-%{DATA:Event}: Login failed [user: %{NUMBER:Service\_Number}] [Source: %{IP:Log\_in\_Source}] %{GREEDYDATA:Information}", "%{MONTH:Month}%{SPACE}%{NUMBER:Day} %{TIME:Time} %{IP:Host} %{NUMBER:SEQ\_NO}: %{DATA:Month\_From\_Device}%{SPACE}%{NUMBER:Day\_From\_Device} %{TIME:Time\_From\_Device}: %%{DATA:Facility}-%{DATA:Severity}-%{DATA:Event}: %{GREEDYDATA:Information}", "%{MONTH:Month}%{SPACE}%{NUMBER:Day} %{TIME:Time} %{IP:Host} %{NUMBER:SEQ\_NO}: %{GREEDYDATA:Information}"  
}  
}  
}

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [October 19, 2018, 6:05am UTC](https://discuss.elastic.co/t/multiple-patterns-in-grok-filter/153106/4 "2018-10-19T06:05:44Z")

</div>

That does not match the example from the docs, does it?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 16, 2018, 6:05am UTC](https://discuss.elastic.co/t/multiple-patterns-in-grok-filter/153106/5 "2018-11-16T06:05:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.