title: Logstash: Keeping a value across events
body: <p>I have a date that is only present once in every log file and I am trying to add this date to all following events after it has been matched once, making it act like a global variable in some ways. (The date is at the top of the document and I am unable to use <code>multiline</code> or make changes to the file name or content)</p>
  
  <p>For this, my approach is to use a <code>grep</code> filter with <code>drop =&gt; false</code>. </p>
  
  <pre><code>grok {
      patterns_dir =&gt; "[...]"
      match =&gt; [ "message", "%{DATELINE}" ]
      tag_on_failure =&gt; [ ]
  }
  grep {
      add_field =&gt; { "grepdate" =&gt; "%{mydate}" }
      drop =&gt; false
  }
  date {
      locale =&gt; "en"
      timezone =&gt; "Europe/Paris"
      match =&gt; [ "grepdate", "yyyyMMdd" ]
      target =&gt; "grepdate"
  }
  </code></pre>
  
  <p><strong>Regular expression:</strong></p>
  
  <pre><code>DATELINE (= Date: (?&lt;mydate&gt;[0-9]{8}))
  </code></pre>
  
  <p>What I notice is that the <code>grepdate</code> field is correctly being added to all events - which is what I want - but the value of that field is not the date itself (the value of <code>%{mydate}</code>), but the actual string <code>"%{mydate}"</code>, except when actually being matched for the first time (when parsing the actual date in my log file, the <code>grepdate</code> field contains the correct value) </p>
  
  <p>What can I do to fix this? </p>
  
  <p>Any help is greatly appreciated.</p>
  
  <p><strong>Edit:</strong></p>
  
  <p>I am now trying a solution that includes the use of the <code>memorize</code>plugin. However, I am getting the following error: </p>
  
  <blockquote>
    <p>Cannot use more than 1 filter worker because the following plugins
    don't work with more than one worker: memorize</p>
  </blockquote>
  
  <p>Is there a way to make this filter thread-safe?</p>