# Unexpected result for grok processor with multiple patterns
**URL:** https://discuss.elastic.co/t/unexpected-result-for-grok-processor-with-multiple-patterns/67153
**Category:** Elasticsearch
**Created:** [November 25, 2016, 5:00am UTC](https://discuss.elastic.co/t/unexpected-result-for-grok-processor-with-multiple-patterns/67153 "2016-11-25T05:00:31Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@ginger](https://discuss.elastic.co/u/ginger)
#### Post date: [November 25, 2016, 5:00am UTC](https://discuss.elastic.co/t/unexpected-result-for-grok-processor-with-multiple-patterns/67153/1 "2016-11-25T05:00:31Z")
Hi.
When use ingest node, I find unexpected result for grok processor with multiple patterns.
The following works right:
> POST \_ingest/pipeline/\_simulate
> {
> "pipeline": {
> "description" : "parse multiple patterns",
> "processors": [
> {
> "grok": {
> "field": "message",
> "patterns": ["%{FAVORITE\_DOG:pet}", "%{FAVORITE\_CAT:pet}"],
> "pattern\_definitions" : {
> "FAVORITE\_DOG" : "beagle",
> "FAVORITE\_CAT" : "burmese"
> }
> }
> }
> ]
> },
> "docs":[
> {
> "\_source": {
> "message": "I love burmese cats!"
> }
> }
> ]
> }
But if I replace "I love burmese cats!" with "I love beagle cats!", the result is unexpected:
> {
> "docs": [
> {
> "doc": {
> "\_type": "\_type",
> "\_index": "\_index",
> "\_id": "\_id",
> "\_source": {
> "message": "I love beagle dogs!"
> },
> "\_ingest": {
> "\_grok\_match\_index": "0",
> "timestamp": "2016-11-25T04:48:51.607+0000"
> }
> }
> }
> ]
> }
There is no pet field in \_source!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 23, 2016, 5:01am UTC](https://discuss.elastic.co/t/unexpected-result-for-grok-processor-with-multiple-patterns/67153/2 "2016-12-23T05:01:19Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.