### Author:  [@emanuelef](https://discuss.elastic.co/u/emanuelef)
#### Post date: [October 18, 2016, 7:10pm UTC](https://discuss.elastic.co/t/mutate-only-matching/63320/1 "2016-10-18T19:10:41Z")
Hi,
I'd like to "extract" some fields from a specific kind of log and convert them to the right type.
I can do that when all logs pass the match but in this case the logs I'm getting have different formats.
So I would like to let the ones not matching go through ( without failing, like if there was no "filter" at all) and only mutate the matching ones.
Now the ones not matching give error and don't go through.
```
filter {
grok {
match => { "message" => "%{TIMESTAMP_ISO8601:ih_timestamp} %{WORD:name} (?\w+\[\d+\]\:) *"}
}
date {
match => ["ih_timestamp", "ISO8601"]
target => "@timestamp"
remove_field => ["ih_timestamp"]
}
kv {
field_split => ", "
}
mutate {
convert => { "duration" => "integer" }
convert => { "bytes" => "integer" }
}
}
```
Thanks for any help.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 19, 2016, 6:06am UTC](https://discuss.elastic.co/t/mutate-only-matching/63320/2 "2016-10-19T06:06:02Z")
Grok failures never cause events to get dropped (unless you explicitly configure Logstash that way). The only consequence of a grok failure is that the event is tagged `_grokparsefailure`, but that behavior can be influenced with the `tag_on_failure` option.
---
### Author:  [@emanuelef](https://discuss.elastic.co/u/emanuelef)
#### Post date: [October 19, 2016, 9:53am UTC](https://discuss.elastic.co/t/mutate-only-matching/63320/3 "2016-10-19T09:53:40Z")
Thanks for replying,
I added:
tag\_on\_failure =\> []
So am I right to assume that if the matching pattern is not met then the rest of the pipeline is skipped (kv, mutate) ?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 19, 2016, 11:00am UTC](https://discuss.elastic.co/t/mutate-only-matching/63320/4 "2016-10-19T11:00:28Z")
> So am I right to assume that if the matching pattern is not met then the rest of the pipeline is skipped
I repeat: The only consequence of a grok failure is that the event is tagged `_grokparsefailure`, but that behavior can be influenced with the `tag_on_failure` option. The rest of the pipeline is _not_ skipped.
---
### Author:  [@emanuelef](https://discuss.elastic.co/u/emanuelef)
#### Post date: [October 19, 2016, 11:08am UTC](https://discuss.elastic.co/t/mutate-only-matching/63320/5 "2016-10-19T11:08:29Z")
Thanks again,
and what if I wanted to skip kv, and mutate when logs are not matching in grok ?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 19, 2016, 11:09am UTC](https://discuss.elastic.co/t/mutate-only-matching/63320/6 "2016-10-19T11:09:51Z")
There's an example here:
[https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#conditionals](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#conditionals)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:33am UTC](https://discuss.elastic.co/t/mutate-only-matching/63320/7 "2017-07-06T04:33:34Z")