# Poorly structured log file
**URL:** https://discuss.elastic.co/t/poorly-structured-log-file/1935
**Category:** Logstash
**Created:** [June 4, 2015, 1:32pm UTC](https://discuss.elastic.co/t/poorly-structured-log-file/1935 "2015-06-04T13:32:40Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Paolo](https://discuss.elastic.co/u/Paolo)
#### Post date: [June 4, 2015, 1:32pm UTC](https://discuss.elastic.co/t/poorly-structured-log-file/1935/1 "2015-06-04T13:32:40Z")
Hello All,
I am trying to analyze a log file with the logstash-elasticsearch-kibana setup.
I am still a newby about these nice products and I have a big doubt.
The kind of files I will be working with have very different event structures
(there are dozens, maybe hundreds of kinds of events), some of the events are multiline, some not, some contain JAVA code, some contain lists of addresses, some just lines of asterisks, etc...
As far as I understand the configuration of logstash (with grok for example) has to be very precise and even a space mismatch can stop the pipeline. Is there a (kind of easy) way to handle a situation like mine?
Do you have any suggestion?
thank you,
Paolo
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 4, 2015, 1:41pm UTC](https://discuss.elastic.co/t/poorly-structured-log-file/1935/2 "2015-06-04T13:41:10Z")
You can specify multiple grok patterns and have Logstash pick the first one that matches.
Space mismatches won't stop the pipeline. The grok filter will tag the message with `_grokparsefailure` and pass it on.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:38am UTC](https://discuss.elastic.co/t/poorly-structured-log-file/1935/3 "2017-07-06T05:38:33Z")