I am wondering what the best approach to take with my Logstash Grok filters.  I have some filters that are for specific log entries, and won&#39;t apply to all entries.  The ones that don&#39;t apply always generate _grokparsefailure tags.  For example, I have one grok filter that&#39;s for every log entry and it works fine.  Then I have another filter that&#39;s for error messages with tracebacks.  The traceback filter throws a grokparsefailure for every single log entry that doesn&#39;t have a traceback.

I&#39;d prefer to have it just pass the rule if there isn&#39;t a match instead of adding the parsefailure tag. I use the parsefailure tag to find things that aren&#39;t parsing properly, not things that simply didn&#39;t match a particular filter.  Maybe it&#39;s just the nomenclature &quot;parse failure&quot; that gets me.  To me that means there&#39;s something wrong with the filter (e.g. badly formatted), not that it didn&#39;t match.

So the question is, how should I handle this?

- Make the filter pattern optional using ?

- (ab)use the tag_on_failure option by setting it to nothing []

- make the filter conditional using something like &quot;if traceback in message&quot;

- something else I&#39;m not considering?

Thanks in advance.

***EDIT***

I took the path of adding a conditional around the filter:

        if [message] =~ /took\s\d+/ {
            grok {
                patterns_dir =&gt; &quot;/etc/logstash/patterns&quot;
                match =&gt; [&quot;message&quot;, &quot;took\s+(?&lt;servicetime&gt;[\d\.]+)&quot;]
                add_tag =&gt; [ &quot;stats&quot;, &quot;servicetime&quot; ]
            }
        }

Still interested in feedback though.  What is considered &quot;best practice&quot; here?

All Logstash Grok Solutions on Gang of Coders

Total of 1 Logstash Grok Solutions

How to handle non-matching Logstash grok filters