# Skip to end of filter if the grok pattern does not match

**URL:** <https://discuss.elastic.co/t/skip-to-end-of-filter-if-the-grok-pattern-does-not-match/264925>\
**Category:** Logstash\
**Created:** [February 20, 2021, 12:37am UTC](https://discuss.elastic.co/t/skip-to-end-of-filter-if-the-grok-pattern-does-not-match/264925 "2021-02-20T00:37:40Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![newmember](https://avatars.discourse-cdn.com/v4/letter/n/ce7236/32.png) [@newmember](https://discuss.elastic.co/u/newmember)\
**Post date:** [February 20, 2021, 12:37am UTC](https://discuss.elastic.co/t/skip-to-end-of-filter-if-the-grok-pattern-does-not-match/264925/1 "2021-02-20T00:37:40Z")

</div>

Is there a option for a filter so that when the grok pattern does not match skip all the other filter plugins and leave the filter?

Ideal situation is if the grok pattern does not match

1. skip the rest of the filter plugins (mutate, gsub, kv, etc)
2. dont tag the event with "\_grokparsefailure"

Thank you

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 20, 2021, 1:04am UTC](https://discuss.elastic.co/t/skip-to-end-of-filter-if-the-grok-pattern-does-not-match/264925/2 "2021-02-20T01:04:50Z")

</div>

There is no goto or break in the logstash configuration language. What you would have to do is:

```
grok {}
if "_grokparsefailure" in [tags] {
     mutate { remove_tag => ["_grokparsefailure"] }
} else {
    mutate { ... }
    gsub { ... }
    kv { ... }
}
```

---

<div class="post-metadata">

**Author:** ![newmember](https://avatars.discourse-cdn.com/v4/letter/n/ce7236/32.png) [@newmember](https://discuss.elastic.co/u/newmember)\
**Post date:** [February 20, 2021, 2:50am UTC](https://discuss.elastic.co/t/skip-to-end-of-filter-if-the-grok-pattern-does-not-match/264925/3 "2021-02-20T02:50:21Z")

</div>

Thank you @Badger

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 20, 2021, 2:50am UTC](https://discuss.elastic.co/t/skip-to-end-of-filter-if-the-grok-pattern-does-not-match/264925/4 "2021-03-20T02:50:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.