# Unexpected result for "I Love Burmese Cats example" in documentation

**URL:** https://discuss.elastic.co/t/unexpected-result-for-i-love-burmese-cats-example-in-documentation/72706
**Category:** Elasticsearch
**Created:** [January 24, 2017, 10:01pm UTC](https://discuss.elastic.co/t/unexpected-result-for-i-love-burmese-cats-example-in-documentation/72706 "2017-01-24T22:01:34Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![kikecueva](https://avatars.discourse-cdn.com/v4/letter/k/c57346/32.png) [@kikecueva](https://discuss.elastic.co/u/kikecueva)
#### Post date: [January 24, 2017, 10:01pm UTC](https://discuss.elastic.co/t/unexpected-result-for-i-love-burmese-cats-example-in-documentation/72706/1 "2017-01-24T22:01:34Z")

</div>

FIrst of all, there is an not-answered post with this same [issue](https://discuss.elastic.co/t/unexpected-result-for-grok-processor-with-multiple-patterns/67153?source_topic_id=72703) but it is already closed.

I'm testing the "I Love burmese cats!" example from grok processor [documentation](https://www.elastic.co/guide/en/elasticsearch/reference/current/grok-processor.html).

This request:

```
POST _ingest/pipeline/_simulate
{
  "pipeline": {
  "description" : "parse multiple patterns",
  "processors": [
    {
      "grok": {
        "field": "message",
        "patterns": ["%{FAVORITE_DOG:pet}", "%{FAVORITE_CAT:pet}"],
        "pattern_definitions" : {
          "FAVORITE_DOG" : "beagle",
          "FAVORITE_CAT" : "burmese"
        },
        "trace_match": true
      }
    }
  ]
},
"docs":[
  {
    "_source": {
      "message": "I love burmese cats!"
    }
  }
  ]
}

```

Is showing this output and is working as expected:

```
{
  "docs": [
    {
      "doc": {
        "_id": "_id",
        "_type": "_type",
        "_index": "_index",
        "_source": {
          "message": "burmese",
          "pet": "burmese"
        },
        "_ingest": {
          "_grok_match_index": "1",
          "timestamp": "2017-01-24T21:33:06.192+0000"
        }
      }
    }
  ]
}

```

But if I test the other case (when "message": "I love beagle cats!"):

```
POST _ingest/pipeline/_simulate
{
  "pipeline": {
  "description" : "parse multiple patterns",
  "processors": [
    {
      "grok": {
        "field": "message",
        "patterns": ["%{FAVORITE_DOG:pet}", "%{FAVORITE_CAT:pet}"],
        "pattern_definitions" : {
          "FAVORITE_DOG" : "beagle",
          "FAVORITE_CAT" : "burmese"
        },
        "trace_match": true
      }
    }
  ]
},
"docs":[
  {
    "_source": {
      "message": "I love beagle cats!"
    }
  }
  ]
}

```

The output is not the expected, "pet" field is not being pupulated but "\_grok\_match\_index" is saying that the message matched with the 1st pattern:

```
{
  "docs": [
    {
      "doc": {
        "_id": "_id",
        "_type": "_type",
        "_index": "_index",
        "_source": {
          "message": "I love beagle cats!"
        },
        "_ingest": {
          "_grok_match_index": "0",
          "timestamp": "2017-01-24T21:58:10.042+0000"
        }
      }
    }
  ]
}

```

What am I doing wrong? Is this a bug?

BTW I'm using ELK 5.1

Thanks in advance!

---

<div class="post-metadata">

### Author: ![kikecueva](https://avatars.discourse-cdn.com/v4/letter/k/c57346/32.png) [@kikecueva](https://discuss.elastic.co/u/kikecueva)
#### Post date: [January 24, 2017, 10:03pm UTC](https://discuss.elastic.co/t/unexpected-result-for-i-love-burmese-cats-example-in-documentation/72706/2 "2017-01-24T22:03:59Z")

</div>

If I use different field names (pet1 and pet2) is working fine:

```
POST _ingest/pipeline/_simulate
{
  "pipeline": {
  "description" : "parse multiple patterns",
  "processors": [
    {
      "grok": {
        "field": "message",
        "patterns": ["%{FAVORITE_DOG:pet1}", "%{FAVORITE_CAT:pet2}"],
        "pattern_definitions" : {
          "FAVORITE_DOG" : "beagle",
          "FAVORITE_CAT" : "burmese"
        },
        "trace_match": true
      }
    }
  ]
},
"docs":[
  {
    "_source": {
      "message": "I love beagle cats!"
    }
  },
  {
    "_source": {
      "message": "I love burmese cats!"
    }
  }
  ]
}

```

Output:

```
{
  "docs": [
    {
      "doc": {
        "_id": "_id",
        "_type": "_type",
        "_index": "_index",
        "_source": {
          "message": "I love beagle cats!",
          "pet1": "beagle"
        },
        "_ingest": {
          "_grok_match_index": "0",
          "timestamp": "2017-01-24T22:02:43.181+0000"
        }
      }
    },
    {
      "doc": {
        "_id": "_id",
        "_type": "_type",
        "_index": "_index",
        "_source": {
          "message": "I love burmese cats!",
          "pet2": "burmese"
        },
        "_ingest": {
          "_grok_match_index": "1",
          "timestamp": "2017-01-24T22:02:43.181+0000"
        }
      }
    }
  ]
}

```

But then what if I want the value in the same **pet** field. Is it possible? How can use the same **pet** field?

Thanks

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 21, 2017, 10:04pm UTC](https://discuss.elastic.co/t/unexpected-result-for-i-love-burmese-cats-example-in-documentation/72706/3 "2017-02-21T22:04:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.