How does the grok filter work in logstash
<p>I am writing a Logstash configuration file.</p>

<p>I have a grok filter.
I would like to know how the match in the grok filter works exactly.</p>

<p>I referred to one example in the logstash side and saw the following:</p>

<p>Ex log: <code>55.3.244.1 GET /index.html 15824 0.043</code><br>
It is parsed with the filter below:</p>

<pre><code>filter {
  grok {
    match =&gt; { "message" =&gt; "%{IP:client} %{WORD:method} %{URIPATHPARAM:request} %{NUMBER:bytes} %{NUMBER:duration}" }
  }
</code></pre>

<p>This means we are trying to match the whole log line sequentially?
My logs lines are different. They are not always in a proper framework.<br>
Its like the ones below:</p>

<pre><code> 1. 11:10:15---somedata
 2. 11:10:20---source--destination-- somedata
 3. somedata
</code></pre>

<p>I would want to capture all three types lines
So should I write different match filters? or is it fine to capture source, destination , somedata fields separately in a sigle match?</p>

<p>Seeking for information on this.</p>

<p>yes i do understand the basics of regex and the grok patterns.But I am still confused on how i can write match block for the following.</p>

<pre><code>line 1: timestamp source destination a=0,b=1,c=3,d=4
line 2: timestamp a=1,e=5, b=1
line 3: g=0
</code></pre>

<p>suppose i have these 3 lines in my log file and i would want to capture lines that have the value for b and g. What would be my match block look like?</p>

<pre><code>match =&gt; message ["b=":variable_b,"g=":variable_g]
</code></pre>

<p>Will this capture all the lines with b and g?? for b it should capture 1 and 2 lines. for g it has to capture 3. So my output should have all the three lines?? Is this how it works or would it throw a grokparse error??</p>