# Can't grok multiline logs

**URL:** https://discuss.elastic.co/t/cant-grok-multiline-logs/106435
**Category:** Logstash
**Created:** [November 5, 2017, 3:54pm UTC](https://discuss.elastic.co/t/cant-grok-multiline-logs/106435 "2017-11-05T15:54:38Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![p0f1g1st](https://avatars.discourse-cdn.com/v4/letter/p/b4bc9f/32.png) [@p0f1g1st](https://discuss.elastic.co/u/p0f1g1st)
#### Post date: [November 5, 2017, 3:54pm UTC](https://discuss.elastic.co/t/cant-grok-multiline-logs/106435/1 "2017-11-05T15:54:38Z")

</div>

I have logs where each event is:

```
ExitNode FF33F91CC06B6CC5C3EE804E7D8DBE42CB5707F9
Published 2017-11-05 02:55:09
LastStatus 2017-11-05 04:02:27
ExitAddress 66.42.224.235 2017-11-05 04:06:26

```

I tried to use multiline:

```
input {
   file {
     path => "/path/input"
   }
}
filter {
  multiline {
    pattern => "^\b[A-Za-z]{8}\b"
      what => "next"
  }
}
filter {
  multiline {
    pattern => "^\b[A-Za-z]{8}\b"
      what => "next"
  }
}
filter {
  multiline {
    pattern => "^\b[A-Za-z]{11}\b"
      what => "previous"
  }
}
output {
  file {
    codec => rubydebug
    path => "/path/output"
  }
}

```

And I get something like this:

```
{
          "path" => "/path/input",
    "@timestamp" => 2017-11-05T10:25:34.112Z,
      "@version" => "1",
          "host" => "HOST",
       "message" => "ExitNode FE3CB742E73674F1BC2382723209ECEE44AD4AEC\nPublished 2017-11-04 20:34:55\nLastStatus 2017-11-04 21:03:26\nExitAddress 77.250.227.12 2017-11-04 21:06:45",
          "tags" => [
        [0] "multiline"
    ]
}

```

And I can't grok this message field because I don't know how to remove or replace \n and gsub =\> ["message", "\n", "Line\_Break"] doesn't work properly. Thanks

---

<div class="post-metadata">

### Author: ![paz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paz/32/28003_2.png) [@paz](https://discuss.elastic.co/u/paz)
#### Post date: [November 6, 2017, 11:51am UTC](https://discuss.elastic.co/t/cant-grok-multiline-logs/106435/2 "2017-11-06T11:51:51Z")

</div>

You don't really need to remove newline literals in order to grok this message, you can just escape it in the pattern, like this:

```auto
ExitNode %{NOTSPACE:exitnode}\\nPublished %{TIMESTAMP_ISO8601:published}\\nLastStatus %{TIMESTAMP_ISO8601:laststatus}\\nExitAddress %{IPV4:exitaddress} %{TIMESTAMP_ISO8601:timestamp}
```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 4, 2017, 11:52am UTC](https://discuss.elastic.co/t/cant-grok-multiline-logs/106435/3 "2017-12-04T11:52:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.