How to mass delete duplicate GROK patterns?

Not sure why but all my GROK patterns show twice. Its entirely possible I imported the same set twice. I can see a delete button to the right of each pattern but that would take me hours, is there a quick way?

You can drop the “grok_patterns” collection in MongoDB and re-import your patterns.

FWIW, if there really are duplicate Grok patterns, this is a bug. In this case please create a bug report at

I’m 99% sure I caused this by applying the content pack twice as there is no way to see if this has already happened or not. Also, this is simply a cosmetical / OCD issue for me and in no way impacts the way Graylog is working for me.

Couldn’t add 2 images in one post.

I have exactly the same issue:
I am sure I have never clicked on Apply Content Pack.
I think in my case duplicate entries came from the Graylog update.

I saw your thread but it was closed so I opened my own :slight_smile:

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.