# Two or more filters in Logstash **URL:** \ **Category:** Logstash\ **Created:** [December 18, 2019, 3:04pm UTC](https://discuss.elastic.co/t/two-or-more-filters-in-logstash/212351 "2019-12-18T15:04:16Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Paul\_Sternberg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paul_sternberg/32/45595_2.png) [@Paul\_Sternberg](https://discuss.elastic.co/u/Paul_Sternberg)\ **Post date:** [December 18, 2019, 3:04pm UTC](https://discuss.elastic.co/t/two-or-more-filters-in-logstash/212351/1 "2019-12-18T15:04:16Z")
Hi folks! May be somebody know how to use 2 or more filters block or 2 or more grok blocks in logstash configuration? My current configuration looks like this: input { udp { port =\> 5514 type =\> syslog } } input { beats { port =\> 5044 } } filter { grok { patterns\_dir =\> ["/etc/logstash/patterns/ciscotest1"] match =\> { "message" =\> "%{CISCONEWWIFIACCESSCREATED}"} add\_field =\> { "Event\_ID" =\> "CI-0001" "Severity" =\> "30" } } } filter { grok { patterns\_dir =\> ["/etc/logstash/patterns/ciscotest2"] match =\> { "message" =\> "%{CISCOOLDCONNECTNOTVERIFYED}"} add\_field =\> { "Event\_ID" =\> "CI-0002" "Severity" =\> "35" } } } output { if "\_grokparsefailure" in [tags] { file { path =\> "/var/log/custom/custom.log" } } else { elasticsearch { hosts =\> ["testbuild12.local:9200"] index =\> "index-%{+YYYY.MM.dd}" } } } So, it start without any problem, but marks all logs as "grokparsefailure". In time when I use only one filter block for only one condition of grok - it works. So the main question is, how to rebuild this config? ---
**Author:** ![ITIC](https://avatars.discourse-cdn.com/v4/letter/i/90ced4/32.png) [@ITIC](https://discuss.elastic.co/u/ITIC)\ **Post date:** [December 19, 2019, 7:18am UTC](https://discuss.elastic.co/t/two-or-more-filters-in-logstash/212351/2 "2019-12-19T07:18:15Z")
Hi You only need one instance of each `input{}`, `filter{}` and `output{}`, and you can have as many plugins as you need in each of them. In your case, you'll have one `filter{}` with two `grok{}` instances. If you need one `grok{}` for your `udp{}` input and one for your `beats{}` input, you have to use `tags` and `id` to separate them. Hope this helps ---
**Author:** ![Paul\_Sternberg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paul_sternberg/32/45595_2.png) [@Paul\_Sternberg](https://discuss.elastic.co/u/Paul_Sternberg)\ **Post date:** [December 19, 2019, 8:39am UTC](https://discuss.elastic.co/t/two-or-more-filters-in-logstash/212351/3 "2019-12-19T08:39:39Z")
Hi! So, I tried this configuration before with 2 grok elements in 1 filter - this cfg doesn't give any errors, but it just doesn't parse any logs. ---
**Author:** ![ITIC](https://avatars.discourse-cdn.com/v4/letter/i/90ced4/32.png) [@ITIC](https://discuss.elastic.co/u/ITIC)\ **Post date:** [December 19, 2019, 8:47am UTC](https://discuss.elastic.co/t/two-or-more-filters-in-logstash/212351/4 "2019-12-19T08:47:15Z")
Hi You could try checking your `match` syntax, one `grok{}` at a time, against a known, simple, input. Send the output to `stdout{}` to see what you get, in detail. That will help you debug your code. Hope this helps ---
**Author:** ![Paul\_Sternberg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paul_sternberg/32/45595_2.png) [@Paul\_Sternberg](https://discuss.elastic.co/u/Paul_Sternberg)\ **Post date:** [December 19, 2019, 9:03am UTC](https://discuss.elastic.co/t/two-or-more-filters-in-logstash/212351/5 "2019-12-19T09:03:55Z")
Also tried. Same result as in previous message. ---
**Author:** ![Paul\_Sternberg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paul_sternberg/32/45595_2.png) [@Paul\_Sternberg](https://discuss.elastic.co/u/Paul_Sternberg)\ **Post date:** [December 19, 2019, 9:05am UTC](https://discuss.elastic.co/t/two-or-more-filters-in-logstash/212351/6 "2019-12-19T09:05:31Z")
I also had an idea of writing if statement and use regex for it like: "if [message] =~ /regex/" but it always give an error. ---
**Author:** ![ITIC](https://avatars.discourse-cdn.com/v4/letter/i/90ced4/32.png) [@ITIC](https://discuss.elastic.co/u/ITIC)\ **Post date:** [December 19, 2019, 12:11pm UTC](https://discuss.elastic.co/t/two-or-more-filters-in-logstash/212351/7 "2019-12-19T12:11:25Z")
Hi I think your `match` pattern should be something like ```auto match => { "message" => "%{CISCONEWWIFIACCESSCREATED:cnwaccesscreated}"} ``` where `cnwaccesscreated` (i made the name up) is a new custom field containing the parsed contents from your `message`. Hope this helps ---
**Author:** ![Paul\_Sternberg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paul_sternberg/32/45595_2.png) [@Paul\_Sternberg](https://discuss.elastic.co/u/Paul_Sternberg)\ **Post date:** [December 19, 2019, 1:47pm UTC](https://discuss.elastic.co/t/two-or-more-filters-in-logstash/212351/8 "2019-12-19T13:47:01Z")
So okay, I solved it. More than 2 grok definitions can work only with if/elseif/else statement between them. Without some type of stopper - it will grok ur log in every grok definition and send it to \_grokparsefailure. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 16, 2020, 1:47pm UTC](https://discuss.elastic.co/t/two-or-more-filters-in-logstash/212351/9 "2020-01-16T13:47:04Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.