# Bring another 10 or more lines after the search term

**URL:** https://discuss.elastic.co/t/bring-another-10-or-more-lines-after-the-search-term/61945
**Category:** Kibana
**Created:** [September 30, 2016, 4:33pm UTC](https://discuss.elastic.co/t/bring-another-10-or-more-lines-after-the-search-term/61945 "2016-09-30T16:33:12Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Bernardo\_Cancado](https://avatars.discourse-cdn.com/v4/letter/b/b9e5f3/32.png) [@Bernardo\_Cancado](https://discuss.elastic.co/u/Bernardo_Cancado)
#### Post date: [September 30, 2016, 4:33pm UTC](https://discuss.elastic.co/t/bring-another-10-or-more-lines-after-the-search-term/61945/1 "2016-09-30T16:33:12Z")

</div>

Hi.

I can´t get the lines below the search term. Entçao when I search "NSSAFG69SCNE014084333" just the line that contains the search term is returned, but I need a few lines below.  
An example of search return below.

@timestamp:  
September 30th 2016, 10:01:30.022  
message:  
2016-09-30 10:01:29,533 INFO [BROKER] (ajp-0.0.0.0-8009-255) ##BROKER ENVIO Hora: 10:1:29:533 BROKER: br.gov.prodigio.persistencia.mainframe.MainFrameDAOHelper@2a803efc - NSSAFG69SCNE014084333  
@version:  
1  
path:  
/var/log/jboss/broker.log  
host:  
webpcnetp02  
type:  
pcnet  
\_id:  
AVd7L3YqGE8IPmeDdYCi  
\_type:  
pcnet  
\_index:  
pcnet-2016.09.30  
\_score:

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [October 1, 2016, 11:26am UTC](https://discuss.elastic.co/t/bring-another-10-or-more-lines-after-the-search-term/61945/2 "2016-10-01T11:26:52Z")

</div>

Are you suggesting that the original message is multiline?

---

<div class="post-metadata">

### Author: ![Bernardo\_Cancado](https://avatars.discourse-cdn.com/v4/letter/b/b9e5f3/32.png) [@Bernardo\_Cancado](https://discuss.elastic.co/u/Bernardo_Cancado)
#### Post date: [October 1, 2016, 2:22pm UTC](https://discuss.elastic.co/t/bring-another-10-or-more-lines-after-the-search-term/61945/3 "2016-10-01T14:22:49Z")

</div>

No. In this case is a communication via entire broker, so I sent some information and get a response.  
In Kibana I search a shipping passage and need to see the answer.

Example:  
2016-10-01 00:00:10,456 INFO [BROKER] (ajp-0.0.0.0-8009-24) ##BROKER SEND Hora: 0:0:10:456 BROKER: [br.gov](http://br.gov) - NSSAFG69SCNE014084333  
2016-10-01 00:00:10,456 INFO [BROKER] (ajp-0.0.0.0-8009-24) ##BROKER RETURN CACHE Hora: 0:0:10:456 BROKER: [br.gov](http://br.gov) ##TEMPO:0ms - null

Where: "NSSAFG69SCNE014084333" is my search term.  
In the other case is the server.log of jboss where I look for a mistake and need to see the lines below that display the error track.

Maybe i have to search my mistake and when you find something so I make the search by start time to end time.

Kibana was implemented in the company I work for, I did not know the tool and hand tool are not very explanatory.

Thanks.

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [October 1, 2016, 3:19pm UTC](https://discuss.elastic.co/t/bring-another-10-or-more-lines-after-the-search-term/61945/4 "2016-10-01T15:19:43Z")

</div>

Ok, KB can't currently do this. There's an open feature request to have it added though.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 1:37pm UTC](https://discuss.elastic.co/t/bring-another-10-or-more-lines-after-the-search-term/61945/5 "2017-07-06T13:37:44Z")

</div>


