# Only the first pattern in the message field is worling, others are ignored

**URL:** <https://discuss.elastic.co/t/only-the-first-pattern-in-the-message-field-is-worling-others-are-ignored/84253>\
**Category:** Logstash\
**Created:** [May 2, 2017, 11:51am UTC](https://discuss.elastic.co/t/only-the-first-pattern-in-the-message-field-is-worling-others-are-ignored/84253 "2017-05-02T11:51:15Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Darya\_Semenova](https://avatars.discourse-cdn.com/v4/letter/d/7ba0ec/32.png) [@Darya\_Semenova](https://discuss.elastic.co/u/Darya_Semenova)\
**Post date:** [May 2, 2017, 11:51am UTC](https://discuss.elastic.co/t/only-the-first-pattern-in-the-message-field-is-worling-others-are-ignored/84253/1 "2017-05-02T11:51:15Z")

</div>

For some reason for the code like this:

```
filter {
    if [type] == "syslog" and !("parsed_by_slurm_filter" in [tags]) and !("parsed_by_xcat_filter" in [tags]) {
        grok {
            patterns_dir => ["./patterns"]
            remove_tag => ["_grokparsefailure"]
            match => {
                 "message" => ["%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}", "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(\(etc/cron\.hourly\))(?:\[%{POSINT:syslog_pid}) %{GREEDYDATA:syslog_message}", "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\]) %{GREEDYDATA:syslog_message}"]
             }
        add_field => ["received_at", "%{@timestamp}"]
        add_field => ["received_from", "%{host}"]
        }
    }
}

```

Only the first pattern

```
"%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}"

```

works, but for example,

```
"%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(\(etc/cron\.hourly\))(?:\[%{POSINT:syslog_pid}) %{GREEDYDATA:syslog_message}"

```

seems to be ignored completely.

---

<div class="post-metadata">

**Author:** ![riddhijit\_roy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/riddhijit_roy/32/19049_2.png) [@riddhijit\_roy](https://discuss.elastic.co/u/riddhijit_roy)\
**Post date:** [May 2, 2017, 12:16pm UTC](https://discuss.elastic.co/t/only-the-first-pattern-in-the-message-field-is-worling-others-are-ignored/84253/2 "2017-05-02T12:16:26Z")

</div>

Try this out

grok {  
break\_on\_match =\> true  
match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{SYSLOGHOST:syslog\_hostname} %{DATA:syslog\_program}((etc/cron.hourly))(?:[%{POSINT:syslog\_pid}) %{GREEDYDATA:syslog\_message}"}  
match =\> { "message"=\> "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{SYSLOGHOST:syslog\_hostname} %{DATA:syslog\_program}(?:[%{POSINT:syslog\_pid}])?: %{GREEDYDATA:syslog\_message}"}  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 30, 2017, 12:23pm UTC](https://discuss.elastic.co/t/only-the-first-pattern-in-the-message-field-is-worling-others-are-ignored/84253/3 "2017-05-30T12:23:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.