# Writing multiple grok filters

**URL:** https://discuss.elastic.co/t/writing-multiple-grok-filters/223095
**Category:** Logstash
**Created:** [March 11, 2020, 10:05am UTC](https://discuss.elastic.co/t/writing-multiple-grok-filters/223095 "2020-03-11T10:05:04Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![Hari\_Krishna](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hari_krishna/32/62678_2.png) [@Hari\_Krishna](https://discuss.elastic.co/u/Hari_Krishna)
#### Post date: [March 11, 2020, 10:05am UTC](https://discuss.elastic.co/t/writing-multiple-grok-filters/223095/1 "2020-03-11T10:05:05Z")

</div>

**This is how my log looks like:**

2020-03-06 09:41:13.756480168 re0:ndp:18310 NDP\_TP\_NDP\_MSG Function = "NdpIRBNhMapHandler", message = "NdpIRBNhMapHandler Entered"  
2020-03-06 09:41:13.756485401 re0:ndp:18310 lltp\_debug message = "NDP-DBG:NdpIRBNhMapHandler:381:: NdpIRBNhMapHandler Entered"  
2020-03-06 09:41:13.770434539 re0:ndp:18310 BQEvents\_BQ\_OBJ\_EVENT Guid = 893353199931, Op = "USER DEL CB", Obj = 0x7F6B8FE9DB00, Type\_info = "AddrResolveReq"

This is the filter that i have written:

```
        pattern_definitions => { "mssg" => "((Msg|message|Message|message1|message2) [=])" }
        match => {
                "message" => ["%{TIMESTAMP_ISO8601:timestamp} %{WORD:node}:%{WORD:program}:%{INT:pid} %{WORD:tracetype}.*%{mssg} \"%{GREEDYDATA:Message}\""]
                         }

```

But this works only for the logs with "message".  
The Function and message fields do not occur in all the logs. How can i write filters to match multiple patterns?

---

<div class="post-metadata">

### Author: ![ITIC](https://avatars.discourse-cdn.com/v4/letter/i/90ced4/32.png) [@ITIC](https://discuss.elastic.co/u/ITIC)
#### Post date: [March 11, 2020, 10:23am UTC](https://discuss.elastic.co/t/writing-multiple-grok-filters/223095/2 "2020-03-11T10:23:02Z")

</div>

Hi

Find a way to distinguish the different types of log entries you'll be getting and use `if` statements to call different `grok{}` instances, one for each type.

Hope this helps

---

<div class="post-metadata">

### Author: ![Hari\_Krishna](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hari_krishna/32/62678_2.png) [@Hari\_Krishna](https://discuss.elastic.co/u/Hari_Krishna)
#### Post date: [March 12, 2020, 9:22am UTC](https://discuss.elastic.co/t/writing-multiple-grok-filters/223095/3 "2020-03-12T09:22:27Z")

</div>

Hi Jordi,

Can you please give me an example on how to write if statements to call different `grok{}` instances?

---

<div class="post-metadata">

### Author: ![ITIC](https://avatars.discourse-cdn.com/v4/letter/i/90ced4/32.png) [@ITIC](https://discuss.elastic.co/u/ITIC)
#### Post date: [March 12, 2020, 10:35am UTC](https://discuss.elastic.co/t/writing-multiple-grok-filters/223095/4 "2020-03-12T10:35:53Z")

</div>

Hi

Take a look at this documentation: [https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#conditionals](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#conditionals)

Let's say you want the word "message" in your `mssg` field, you'd do like this:

```auto
filter {
  if "message" in [mssg] {
	grok {<whatever you need to do here>}
  }
  else {
	<whatever you need to do here, maybe another gork{} filter>
  }
}

```

Hope this helps

---

<div class="post-metadata">

### Author: ![Hari\_Krishna](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hari_krishna/32/62678_2.png) [@Hari\_Krishna](https://discuss.elastic.co/u/Hari_Krishna)
#### Post date: [March 12, 2020, 10:54am UTC](https://discuss.elastic.co/t/writing-multiple-grok-filters/223095/5 "2020-03-12T10:54:37Z")

</div>

Thanks Jordi  
I'll try it out

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 9, 2020, 11:03am UTC](https://discuss.elastic.co/t/writing-multiple-grok-filters/223095/6 "2020-04-09T11:03:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.