# A multilne message - how to deal with?
**URL:** https://discuss.elastic.co/t/a-multilne-message-how-to-deal-with/269375
**Category:** Logstash
**Created:** [April 6, 2021, 7:30pm UTC](https://discuss.elastic.co/t/a-multilne-message-how-to-deal-with/269375 "2021-04-06T19:30:32Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@awer1967](https://discuss.elastic.co/u/awer1967)
#### Post date: [April 6, 2021, 7:30pm UTC](https://discuss.elastic.co/t/a-multilne-message-how-to-deal-with/269375/1 "2021-04-06T19:30:33Z")
Hello !
I am in complete stuck in some dealing with Logstash.
There is a non-structured information gotten from one source , divided by \n char
I cut it out in input section into set of messages with the multiline codec .
So I get the information before filtering looks like it :
`message: "Block1"`
`message: " Attribut1:Value1" `
`message: " Attribut2:Value2"`
`message: " Attribut3:Value3"`
`message: "\r" `
`message: "Block2"`
`message: " Attribut12:Value11" `
`message: " Attribut23:Value21"`
`message: " Attribut33:Value34"`
`message: "\r" `
I'd like to merge that messages into something similar to
`message: {Block1:["Attribut1:Value1" ," Attribut2:Value2"," Attribut3:Value3"]}`
`message: {Block2:["Attribut12:Value11" ," Attribut23:Value21"," Attribut33:Value34"]}`
but I am not able to find a way how to do it properly. Neither aggregate nor grok seems to me could play in my case. Wouldn't you be so kind to show me how to deal with it ?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 6, 2021, 9:40pm UTC](https://discuss.elastic.co/t/a-multilne-message-how-to-deal-with/269375/2 "2021-04-06T21:40:36Z")
It is not clear what your message looks like, but if it is
```
"message" => "Block1\n Attribut1:Value1\n Attribut2:Value2\n Attribut3:Value3\n\r\nBlock2\n Attribut12:Value11\n Attribut23:Value21\n Attribut33:Value34\n\r",
```
then
```
mutate { split => { "message" => "^M" } }
split { field => "message" }
mutate { gsub => ["message", "^\n", ""] }
mutate { split => { "message" => "
" } }
ruby {
code => '
message = event.get("message")
name = message.shift(1).to_s.gsub(/\"/, "")
event.set(name, message)
'
}
```
will get you two events, the second one with
```
"Block2" => [
[0] " Attribut12:Value11",
[1] " Attribut23:Value21",
[2] " Attribut33:Value34"
],
```
---
### Author:  [@awer1967](https://discuss.elastic.co/u/awer1967)
#### Post date: [April 7, 2021, 3:53am UTC](https://discuss.elastic.co/t/a-multilne-message-how-to-deal-with/269375/3 "2021-04-07T03:53:14Z")
Thank You a LOT !
It is a decision I have been looking for !
Yes, sure , my raw message looks like you've described , so yes, it could be changed without applying multiline in input. That is the trick.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 5, 2021, 3:54am UTC](https://discuss.elastic.co/t/a-multilne-message-how-to-deal-with/269375/4 "2021-05-05T03:54:08Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.