# Questions about Grok and add\_tag

**URL:** <https://discuss.elastic.co/t/questions-about-grok-and-add-tag/42475>\
**Category:** Logstash\
**Created:** [February 23, 2016, 9:18am UTC](https://discuss.elastic.co/t/questions-about-grok-and-add-tag/42475 "2016-02-23T09:18:42Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![guojingjing](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guojingjing/32/8205_2.png) [@guojingjing](https://discuss.elastic.co/u/guojingjing)\
**Post date:** [February 23, 2016, 9:18am UTC](https://discuss.elastic.co/t/questions-about-grok-and-add-tag/42475/1 "2016-02-23T09:18:42Z")

</div>

Anyone can help with my two questions regarding grok and add\_tag?

1. Can grok be used more than once in the filter part?

after my first grok, which worked perfectly, I added a second grok to extract some more information from the same event messages. As a test, I simply asked my second grok to add a tag, say "grokked2". I am expecting the new tag to show on all events, but the new tag showed as "\_grokparsefailure".

1. I also was confused why add\_tag won't work with the below config file:  
input{ stdin{} }  
filter{ grok{add\_tag =\> ["grokked"]} }  
output{ codec=\>rubydebug }

Also resulted in a "\_grokparsefailure" tag.

Thanks a lot!

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 23, 2016, 6:54pm UTC](https://discuss.elastic.co/t/questions-about-grok-and-add-tag/42475/2 "2016-02-23T18:54:54Z")

</div>

> 1. Can grok be used more than once in the filter part?

Yes.

> 1. I also was confused why add\_tag won't work with the below config file:

The `add_tag` option normally fires only when the filter is successful, and a grok filter can't succeed if it doesn't have anything to match. If you want to unconditionally add a tag use the mutate filter.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:10am UTC](https://discuss.elastic.co/t/questions-about-grok-and-add-tag/42475/3 "2017-07-06T05:10:02Z")

</div>