# \[SOLVED\] Grok - multiple match lines - set tag based on which grok match was used

**URL:** https://discuss.elastic.co/t/solved-grok-multiple-match-lines-set-tag-based-on-which-grok-match-was-used/190368
**Category:** Logstash
**Created:** [July 14, 2019, 4:03am UTC](https://discuss.elastic.co/t/solved-grok-multiple-match-lines-set-tag-based-on-which-grok-match-was-used/190368 "2019-07-14T04:03:12Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![nnet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nnet/32/25982_2.png) [@nnet](https://discuss.elastic.co/u/nnet)
#### Post date: [July 14, 2019, 2:44pm UTC](https://discuss.elastic.co/t/solved-grok-multiple-match-lines-set-tag-based-on-which-grok-match-was-used/190368/2 "2019-07-14T14:44:34Z")

</div>

Found this [https://discuss.elastic.co/t/is-there-a-way-to-tag-for-different-grok-matches/52785](https://discuss.elastic.co/t/is-there-a-way-to-tag-for-different-grok-matches/52785) and tried it. Seems to work so far. The bonus is after a while I can see which matches are the most used and reorder them in the conf file to reduce processing.

Here's a snippet as an example for others to use:

```
filter {
  if [document_type] == "syslog" {
    grok {
      match => { "message" =>
      "<%{NONNEGINT:syslog_pri}>%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} invld>%{SYSLOGTIMESTAMP} %{SYSLOGHOST} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}"
      }
    add_field => ["received_at", "%{@timestamp}"]
    add_field => ["received_from", "%{host}"]
    remove_tag => ["_grokparsefailure"]
    add_tag => ["SYSLOG","SYSLOGGROK1"]
    }
    if "_grokparsefailure" in [tags] {
      grok {
        match => { "message" =>
        "<%{NONNEGINT:syslog_pri}>%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} \(\"%{DATA}\"\) %{WORD:syslog_program}: %{GREEDYDATA:syslog_message}"
        }
      add_field => ["received_at", "%{@timestamp}"]
      add_field => ["received_from", "%{host}"]
      remove_tag => ["_grokparsefailure"]
      add_tag => ["SYSLOG","SYSLOGGROK2"]
      }
    }
    if "_grokparsefailure" in [tags] {
      grok {
        match => { "message" =>
        "<%{NONNEGINT:syslog_pri}>%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}\[\s*%{BASE10NUM:syslog_pid}\]: \(%{DATA:syslog_wincommitid}:%{DATA:syslog_winthreadid}:%{DATA:syslog_winchannelid}\) \[%{DATA:syslog_wineventid}:%{DATA:syslog_wintaskid}\.%{DATA:syslog_winopcode}\.%{DATA:syslog_winloglevel}\] %{DATA:syslog_wincommand}\.#012%n%n%{GREEDYDATA:syslog_winmessage}"
        }
      add_field => ["received_at", "%{@timestamp}"]
      add_field => ["received_from", "%{host}"]
      remove_tag => ["_grokparsefailure"]
      add_tag => ["SYSLOG","SYSLOGGROK3"]
      }
    }
...
```

---

_[View the full topic](https://discuss.elastic.co/t/solved-grok-multiple-match-lines-set-tag-based-on-which-grok-match-was-used/190368)._