Do not match after a specific line

[mitsu-ko]

Hi,

Do not match after a specific line in my test case. Is it a known bug?

My test procedure is,
[mitsu-ko@webg203 grok]$ ./grok -f samples/tomcat1.grok
Jun 29, 2008 11:16:20 AM org.apache.catalina.core.ApplicationContext log
Jun 29, 2008 11:16:20 AM org.apache.catalina.core.ApplicationContext log
Jun 29, 2008 11:22:43 AM org.apache.catalina.core.StandardWrapperValve invoke
Jun 29, 2008 11:23:02 AM org.apache.catalina.core.StandardWrapperValve invoke
Jun 29, 2008 11:23:30 AM org.apache.catalina.core.StandardWrapperValve invoke
Jun 29, 2008 11:33:32 AM org.apache.catalina.core.StandardWrapperValve invoke
Jun 29, 2008 11:33:54 AM org.apache.catalina.core.StandardWrapperValve invoke
Jun 29, 2008 11:34:24 AM org.apache.catalina.core.StandardWrapperValve invoke
Jun 29, 2008 11:45:40 AM org.apache.catalina.core.StandardWrapperValve invoke
Jun 29, 2008 11:46:10 AM org.apache.catalina.core.StandardWrapperValve invoke
Jun 29, 2008 11:46:30 AM org.apache.catalina.core.StandardWrapperValve invoke
Jun 29, 2008 11:46:39 AM org.apache.catalina.core.StandardWrapperValve invoke
Jun 29, 2008 11:47:25 AM org.apache.catalina.core.StandardWrapperValve invoke
Jun 29, 2008 11:47:51 AM org.apache.catalina.core.StandardWrapperValve invoke
Jun 29, 2008 11:48:40 AM org.apache.catalina.core.StandardWrapperValve invoke

Then I grep the 'Jun' keyword, then run grok the new file.
[mitsu-ko@webg203 grok]$ grep Jun tomcat1.log >tomcat2.log
[mitsu-ko@webg203 grok]$ ./grok -f samples/tomcat2.grok
Jun 29, 2008 11:16:20 AM org.apache.catalina.core.ApplicationContext log
Jun 29, 2008 11:16:20 AM org.apache.catalina.core.ApplicationContext log
Jun 29, 2008 11:22:43 AM org.apache.catalina.core.StandardWrapperValve invoke
Jun 29, 2008 11:23:02 AM org.apache.catalina.core.StandardWrapperValve invoke
Jun 29, 2008 11:23:30 AM org.apache.catalina.core.StandardWrapperValve invoke
Jun 29, 2008 11:33:32 AM org.apache.catalina.core.StandardWrapperValve invoke
Jun 29, 2008 11:33:54 AM org.apache.catalina.core.StandardWrapperValve invoke
Jun 29, 2008 11:34:24 AM org.apache.catalina.core.StandardWrapperValve invoke
Jun 29, 2008 11:45:40 AM org.apache.catalina.core.StandardWrapperValve invoke
Jun 29, 2008 11:46:10 AM org.apache.catalina.core.StandardWrapperValve invoke
Jun 29, 2008 11:46:30 AM org.apache.catalina.core.StandardWrapperValve invoke
Jun 29, 2008 11:46:39 AM org.apache.catalina.core.StandardWrapperValve invoke
Jun 29, 2008 11:47:25 AM org.apache.catalina.core.StandardWrapperValve invoke
Jun 29, 2008 11:47:51 AM org.apache.catalina.core.StandardWrapperValve invoke
Jun 29, 2008 11:48:40 AM org.apache.catalina.core.StandardWrapperValve invoke
Jun 29, 2008 11:48:54 AM org.apache.catalina.core.ApplicationContext log
Jun 29, 2008 11:48:54 AM org.apache.catalina.core.ApplicationContext log
Jun 29, 2008 11:49:06 AM org.apache.catalina.core.ApplicationContext log
Jun 29, 2008 11:49:06 AM org.apache.catalina.core.ApplicationContext log
Jun 29, 2008 11:49:12 AM org.apache.catalina.core.StandardWrapperValve invoke
Jun 29, 2008 11:49:13 AM org.apache.catalina.core.StandardWrapperValve invoke
Jun 29, 2008 11:49:16 AM org.apache.catalina.core.StandardWrapperValve invoke
Jun 29, 2008 11:49:17 AM org.apache.catalina.core.StandardWrapperValve invoke
Jun 29, 2008 11:49:46 AM org.apache.catalina.core.StandardWrapperValve invoke
Jun 29, 2008 11:53:10 AM org.apache.catalina.core.StandardWrapperValve invoke
Jun 29, 2008 11:56:14 AM org.apache.catalina.core.StandardWrapperValve invoke
Jun 29, 2008 11:57:37 AM org.apache.catalina.core.StandardWrapperValve invoke
Jun 29, 2008 11:57:48 AM org.apache.catalina.core.StandardWrapperValve invoke
Jun 29, 2008 11:58:13 AM org.apache.catalina.core.StandardWrapperValve invoke
Jun 29, 2008 12:03:51 PM org.apache.catalina.core.StandardWrapperValve invoke
Jun 29, 2008 12:08:19 PM org.apache.catalina.core.StandardWrapperValve invoke
Jun 29, 2008 12:10:02 PM org.apache.catalina.core.StandardWrapperValve invoke
Jun 29, 2008 12:10:13 PM org.apache.catalina.core.StandardWrapperValve invoke
Jun 29, 2008 12:13:27 PM org.apache.catalina.core.StandardWrapperValve invoke
Jun 29, 2008 12:14:07 PM org.apache.catalina.core.StandardWrapperValve invoke
Jun 29, 2008 12:23:42 PM org.apache.catalina.core.ApplicationContext log
Jun 29, 2008 12:23:42 PM org.apache.catalina.core.ApplicationContext log
Jun 29, 2008 12:30:09 PM org.apache.catalina.core.ApplicationContext log
Jun 29, 2008 12:30:09 PM org.apache.catalina.core.ApplicationContext log
Jun 29, 2008 12:36:48 PM org.apache.catalina.core.StandardWrapperValve invoke
Jun 29, 2008 12:36:51 PM org.apache.catalina.core.StandardWrapperValve invoke
Jun 29, 2008 12:36:54 PM org.apache.catalina.core.StandardWrapperValve invoke
Jun 29, 2008 1:26:34 PM org.apache.catalina.core.ApplicationContext log
Jun 29, 2008 1:26:34 PM org.apache.catalina.core.ApplicationContext log

All of the log lines are outputted.

My environment is ,

OS: CentOS7.6.1810(64bit) (latest)
other RPM: installed by yum

Best regards,

grok_file.zip