# Can Grok / dissect filter be used only the last line of the input file?

**URL:** <https://discuss.elastic.co/t/can-grok-dissect-filter-be-used-only-the-last-line-of-the-input-file/248718>\
**Category:** Logstash\
**Created:** [September 15, 2020, 5:41pm UTC](https://discuss.elastic.co/t/can-grok-dissect-filter-be-used-only-the-last-line-of-the-input-file/248718 "2020-09-15T17:41:50Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![saurabhc](https://avatars.discourse-cdn.com/v4/letter/s/c68b51/32.png) [@saurabhc](https://discuss.elastic.co/u/saurabhc)\
**Post date:** [September 15, 2020, 5:41pm UTC](https://discuss.elastic.co/t/can-grok-dissect-filter-be-used-only-the-last-line-of-the-input-file/248718/1 "2020-09-15T17:41:50Z")

</div>

**Requirement:** Depending on the value of a particular field in the last line of the input file, add\_field to all the matched pattern outputs with the value of the field.

In the last line of the file, I have a string like "unique\_pattern: ".

Currently I'm trying a filter like below,

```
filter {
	 grok {
  			  ## MATCH ONLY THE LAST LINE 
			  match => { "message" => "unique_pattern: %{DATA:pattern}"
			  ## NOW MATCH OTHER LINES FOR MY REQUIRED PATTERN
			  match => { "message" => "\[%{TIMESTAMP_ISO8601:log_timestamp}\] \[%{WORD:log_level}] %{GREEDYDATA:log_msg} " }
			  
	}
	mutate { remove_field => ["@version", "@timestamp", "type", "host", "path", "locale", "message"] }
	mutate { add_field => { "unique_pattern" => "%{pattern}" } }
}

```

I'm not sure how to check only the LAST-LINE of the input file and also that at the beginning. And then add the unique\_pattern value to each matching line with the value of 'pattern'.

My input file is,

```
[2020-09-15T07:25:15.298+00:00] [INFO] Log Message1
[2020-09-15T07:25:15.300+00:00] [INFO] Log message2
unique_pattern: World

```

I want the unique\_pattern value 'World' printed in each output.

My current Output,

```
{"log_level":"INFO","log_msg":"Log","log_timestamp":"2020-09-15T07:25:15.298+00:00","unique_pattern":"%{pattern}","tags":["bipublisher"]}
{"log_level":"INFO","log_msg":"Log","log_timestamp":"2020-09-15T07:25:15.300+00:00","unique_pattern":"%{pattern}","tags":["bipublisher"]}
{"pattern":"World\r","unique_pattern":"World\r","tags":["multiline","bipublisher"]}

```

My Expected output,

```
{"log_level":"INFO","log_msg":"Log","log_timestamp":"2020-09-15T07:25:15.298+00:00","unique_pattern":"World\r","tags":["infile"]}
{"log_level":"INFO","log_msg":"Log","log_timestamp":"2020-09-15T07:25:15.300+00:00","unique_pattern":"World\r","tags":["infile"]}
{"pattern":"World\r","unique_pattern":"World\r","tags":["multiline","bipublisher"]}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 13, 2020, 5:41pm UTC](https://discuss.elastic.co/t/can-grok-dissect-filter-be-used-only-the-last-line-of-the-input-file/248718/2 "2020-10-13T17:41:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.