# Cant parse multiline log **URL:** \ **Category:** Logstash\ **Created:** [February 14, 2019, 6:56pm UTC](https://discuss.elastic.co/t/cant-parse-multiline-log/168472 "2019-02-14T18:56:46Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Mrcow](https://avatars.discourse-cdn.com/v4/letter/m/58956e/32.png) [@Mrcow](https://discuss.elastic.co/u/Mrcow)\ **Post date:** [February 14, 2019, 6:56pm UTC](https://discuss.elastic.co/t/cant-parse-multiline-log/168472/1 "2019-02-14T18:56:46Z")
i have a one kind of multiline log like this and i dont know how to parse it, all the lines after the first always is the same but can be any number of lines 2019/02/14 11:54:33 BGP: 172.16.10.254 rcvd UPDATE w/ attr: nexthop 172.16.11.1, origin i, localpref 100, metric 13020, community 32098:2000 32098:2015, originator 172.16.11.1, clusterlist 172.16.10.0, path 174 1299 9829 2019/02/14 11:54:33 BGP: 172.16.10.254 rcvd 103.194.28.0/22 2019/02/14 11:54:33 BGP: 172.16.10.254 rcvd 45.249.136.0/22 2019/02/14 11:54:33 BGP: 172.16.10.254 rcvd 117.236.192.0/20 2019/02/14 11:54:33 BGP: 172.16.10.254 rcvd 117.208.240.0/20 2019/02/14 11:54:33 BGP: 172.16.10.254 rcvd 103.213.32.0/22 2019/02/14 11:54:33 BGP: 172.16.10.254 rcvd 192.140.240.0/22 2019/02/14 11:54:33 BGP: 172.16.10.254 rcvd 58.84.20.0/22 2019/02/14 11:54:33 BGP: 172.16.10.254 rcvd 160.202.204.0/22 2019/02/14 11:54:33 BGP: 172.16.10.254 rcvd 103.218.232.0/22 2019/02/14 11:54:33 BGP: 172.16.10.254 rcvd 103.247.52.0/22 2019/02/14 11:54:33 BGP: 172.16.10.254 rcvd 160.202.200.0/22 2019/02/14 11:54:33 BGP: 172.16.10.254 rcvd 160.202.180.0/22 2019/02/14 11:54:33 BGP: 172.16.10.254 rcvd 103.213.36.0/22 2019/02/14 11:54:33 BGP: 172.16.10.254 rcvd 43.239.60.0/22 2019/02/14 11:54:33 BGP: 172.16.10.254 rcvd 43.239.168.0/22 2019/02/14 11:54:33 BGP: 172.16.10.254 rcvd 114.29.248.0/22 2019/02/14 11:54:33 BGP: 172.16.10.254 rcvd 117.236.176.0/20 2019/02/14 11:54:33 BGP: 172.16.10.254 rcvd 137.59.132.0/23 2019/02/14 11:54:33 BGP: 172.16.10.254 rcvd 103.216.148.0/22 2019/02/14 11:54:33 BGP: 172.16.10.254 rcvd 59.93.64.0/20 2019/02/14 11:54:33 BGP: 172.16.10.254 rcvd 117.236.208.0/20 2019/02/14 11:54:33 BGP: 172.16.10.254 rcvd 103.61.214.0/23 2019/02/14 11:54:33 BGP: 172.16.10.254 rcvd 117.248.128.0/22 2019/02/14 11:54:33 BGP: 172.16.10.254 rcvd 117.219.0.0/20 2019/02/14 11:54:33 BGP: 172.16.10.254 rcvd 45.124.154.0/23 2019/02/14 11:54:33 BGP: 172.16.10.254 rcvd 117.240.225.0/24 ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [February 14, 2019, 7:26pm UTC](https://discuss.elastic.co/t/cant-parse-multiline-log/168472/2 "2019-02-14T19:26:23Z")
Do you want to combine those lines, or parse each line as a separate event? ---
**Author:** ![Mrcow](https://avatars.discourse-cdn.com/v4/letter/m/58956e/32.png) [@Mrcow](https://discuss.elastic.co/u/Mrcow)\ **Post date:** [February 14, 2019, 7:34pm UTC](https://discuss.elastic.co/t/cant-parse-multiline-log/168472/3 "2019-02-14T19:34:42Z")
> [@Badger](#): > > separate All the lines are one event so i want to combine all. ---
**Author:** ![Mrcow](https://avatars.discourse-cdn.com/v4/letter/m/58956e/32.png) [@Mrcow](https://discuss.elastic.co/u/Mrcow)\ **Post date:** [February 14, 2019, 7:42pm UTC](https://discuss.elastic.co/t/cant-parse-multiline-log/168472/4 "2019-02-14T19:42:32Z")
The log means all the lines after the first to the end line have the same properties of the first line. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [February 14, 2019, 7:57pm UTC](https://discuss.elastic.co/t/cant-parse-multiline-log/168472/5 "2019-02-14T19:57:56Z")
Well, you could combine all the lines into one using a multiline code with a regexp that never matches. Something like ``` codec => multiline { pattern => "^Spalanzani" negate => true what => "previous" auto_flush_interval => 2 } ``` You can pick apart the first line using grok or dissect. To deal with the list of subnets I would use a ruby filter to scan for a regex. That's going to be easier if we switch all the newlines to be some other character. ``` mutate { gsub => [ "message", " ", "|" ] } ruby { code => ' a = event.get("message").scan(/rcvd ([0-9\.\/]+)\|/) event.set("subnets", a.flatten) ' } ``` will get you ``` "subnets" => [ [0] "103.194.28.0/22", [1] "45.249.136.0/22", [2] "117.236.192.0/20", [...] ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 14, 2019, 7:57pm UTC](https://discuss.elastic.co/t/cant-parse-multiline-log/168472/6 "2019-03-14T19:57:59Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.