title: Multiple pattern to parse in Logstash
body: <p>My log file has more than one pattern including logs in JSON format. I want to parse multiple pattern in grok plugin but it does not seems to be working. </p>
  
  <pre><code>'filter {grok {  break_on_match =&gt; false 
  match =&gt;[ "message", "%{TIMESTAMP_ISO8601:LogDate} %{LOGLEVEL:loglevel} (?&lt;threadName&gt;[^:]+):%{NUMBER:ThreadID} - %{GREEDYDATA:Line}",
             "message","%{TIMESTAMP_ISO8601:LogDate} %{LOGLEVEL:loglevel} (?&lt;threadName&gt;[^:]+):%{NUMBER:ThreadID} - %{IP:Clicnet} - - %{GREEDYDATA:Line}"]}
             json {source =&gt; "Line"}mutate{remove_field =&gt; [ "Line","ThreadID" ]}}'
  </code></pre>
  
  <p>Even though line which is having JSON string parsed successfully, there is grokparsefailure tag.</p>
  
  <p><strong>2017-01-27 11:54:48 INFO PropertiesReader:33 - {"timestamp":1485518878968,"h":"297268184dde", "l":"INFO", "cN":"org.com.logstash.demo", "mN":"loadProperties", "m":"load property file from /var/tmp/conf"}</strong></p>
  
  <pre><code>{
         "message" =&gt; "2017-01-27 11:54:48 INFO PropertiesReader:33 - {\"timestamp\":1485518878968,\"h\":\"297268184dde\", \"l\":\"INFO\", \"cN\":\"org.com.logstash.demo\", \"mN\":\"loadProperties\", \"m\":\"load property file from /var/tmp/conf\"}",
        "@version" =&gt; "1",
      "@timestamp" =&gt; "2017-03-20T17:19:16.316Z",
            "type" =&gt; "stdin",
            "host" =&gt; "ef3b82",
         "LogDate" =&gt; "2017-01-27 11:54:48",
        "loglevel" =&gt; "INFO",
      "threadName" =&gt; "PropertiesReader",
            "tags" =&gt; [
          [0] "_grokparsefailure"
      ],
       "timestamp" =&gt; 1485518878968,
               "h" =&gt; "297268184dde",
               "l" =&gt; "INFO",
              "cN" =&gt; "org.com.logstash.demo",
              "mN" =&gt; "loadProperties",
               "m" =&gt; "load property file from /var/tmp/conf"
  }
  </code></pre>
  
  <p>and 2nd line which do not have JSON is failing completely </p>
  
  <p><strong>2017-01-20 15:46:16 INFO  RequestLog:60 - 10.252.134.34 - - [20/Jan/2017:15:46:16 +0000] "OPTIONS //127.0.0.0:8080/ HTTP/1.1" 404 237  1</strong></p>
  
  <pre><code>Error parsing json {:source=&gt;"Line", :raw=&gt;["10.252.134.34 - - [20/Jan/2017:15:46:16 +0000] \"OPTIONS //127.0.0.0:8080/ HTTP/1.1\" 404 237  1", "[20/Jan/2017:15:46:16 +0000] \"OPTIONS //127.0.0.0:8080/ HTTP/1.1\" 404 237  1"], :exception=&gt;java.lang.ClassCastException: org.jruby.RubyArray cannot be cast to org.jruby.RubyIO, :level=&gt;:warn}
  {
         "message" =&gt; "2017-01-20 15:46:16 INFO  RequestLog:60 - 10.252.134.34 - - [20/Jan/2017:15:46:16 +0000] \"OPTIONS //127.0.0.0:8080/ HTTP/1.1\" 404 237  1",
        "@version" =&gt; "1",
      "@timestamp" =&gt; "2017-03-20T17:19:51.175Z",
            "type" =&gt; "stdin",
            "host" =&gt; "ef3b82",
         "LogDate" =&gt; [
          [0] "2017-01-20 15:46:16",
          [1] "2017-01-20 15:46:16"
      ],
        "loglevel" =&gt; [
          [0] "INFO",
          [1] "INFO"
      ],
      "threadName" =&gt; [
          [0] " RequestLog",
          [1] " RequestLog"
      ],
         "Clicnet" =&gt; "10.252.134.34",
            "tags" =&gt; [
          [0] "_jsonparsefailure"
      ]
  }
  </code></pre>