# Trying to grok, grok **URL:** \ **Category:** Logstash\ **Created:** [March 25, 2017, 7:10pm UTC](https://discuss.elastic.co/t/trying-to-grok-grok/80005 "2017-03-25T19:10:16Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![jmbrown](https://avatars.discourse-cdn.com/v4/letter/j/898d66/32.png) [@jmbrown](https://discuss.elastic.co/u/jmbrown)\ **Post date:** [March 25, 2017, 7:10pm UTC](https://discuss.elastic.co/t/trying-to-grok-grok/80005/1 "2017-03-25T19:10:17Z")
Hi, I'm a newcomer to ELK. Trying to get a few concepts wrapped in my head. I've got several different devices (cisco, juniper, ubiquiti) pushing syslogs to our logstash. I'm trying to figure out how to parse them based on format of of the message string. Does grok pattern match the line and if it doesn't exactly match it tries the next match in sequence? Also is there away to have the hosts or hosts.raw contain the fqdn via a inaddr dns lookup ? Thank you ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [March 27, 2017, 5:19am UTC](https://discuss.elastic.co/t/trying-to-grok-grok/80005/2 "2017-03-27T05:19:10Z")
> Does grok pattern match the line and if it doesn't exactly match it tries the next match in sequence? Yes, if you have a grok filter with multiple expressions in it. > Also is there away to have the hosts or hosts.raw contain the fqdn via a inaddr dns lookup ? Yes, see the dns filter. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 24, 2017, 5:19am UTC](https://discuss.elastic.co/t/trying-to-grok-grok/80005/3 "2017-04-24T05:19:12Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.