title: Logstash grok match 2 patterns
body: <p>Example of log lines: </p>
  
  <pre><code>2017-05-04 10:37:22,972 INFO [My.Super.JAVA.CLASS] Outbound Message bla bla
  2017-05-04 10:38:22,972 INFO [My.Super.JAVA.CLASS] Inbound Message bla bla
  2017-05-04 10:39:22,972 INFO [My.Super.JAVA.CLASS] some other bla bla 
  </code></pre>
  
  <p>What I want to do, is to make 3 patterns, one for each type. So here's what I did: </p>
  
  <pre><code>"message", '(?m)%{DATE_TIME:timestamp}\s*%{LOGLEVEL:level}\s*\[%{JAVACLASS:class}\]\s*Outbound Message%{GREEDYDATA:stuff}']
  "message", '(?m)%{DATE_TIME:timestamp}\s*%{LOGLEVEL:level}\s*\[%{JAVACLASS:class}\]\s*Inbound Message%{GREEDYDATA:otherstuff}']
  "message", '(?m)%{DATE_TIME:timestamp}\s*%{LOGLEVEL:level}\s*\[%{JAVACLASS:class}\]\s*%{GREEDYDATA:messageInfo}'
  </code></pre>
  
  <p>Take for example the first log message, it will match with the first AND the third pattern, obviously because of GREEDYDATA part.
  My question is, How to make the first two messages match only with the first two patterns (like, excluding them from the third pattern)?</p>
  
  <p>UPDATE (SOLVED): 
  I used 'if' in grok. Whenever I match with a pattern, I add a tag 'grokked' to it, and right after that, I test if 'grokked' is in the tags, if it's not, I match with the second pattern and so on... 
  More details: <a href="https://discuss.elastic.co/t/grok-with-conditional-patterns-and-adding-a-tag/43844/2" rel="nofollow noreferrer">https://discuss.elastic.co/t/grok-with-conditional-patterns-and-adding-a-tag/43844/2</a></p>