# Custom logstash grok filter's pattern

**URL:** <https://discuss.elastic.co/t/custom-logstash-grok-filters-pattern/55327>\
**Category:** Logstash\
**Created:** [July 12, 2016, 3:58pm UTC](https://discuss.elastic.co/t/custom-logstash-grok-filters-pattern/55327 "2016-07-12T15:58:44Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![asoong-94](https://avatars.discourse-cdn.com/v4/letter/a/ecd19e/32.png) [@asoong-94](https://discuss.elastic.co/u/asoong-94)\
**Post date:** [July 12, 2016, 3:58pm UTC](https://discuss.elastic.co/t/custom-logstash-grok-filters-pattern/55327/1 "2016-07-12T15:58:44Z")

</div>

I am trying to parse through log files that are separated by a row of dashes before and after each log file condensed into one document. I was thinking of creating a custom grok pattern and putting in patterns\_dir. And then using the multiline filter to read up to a row of dashes, and set what =\> "previous"

WOULD THIS WORK? is there a way to create a custom grok pattern for a row of dashes?

----------------------------------------

logfile 

----------------------------------------

log file

----------------------------------------

log file

----------------------------------------

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 13, 2016, 5:38am UTC](https://discuss.elastic.co/t/custom-logstash-grok-filters-pattern/55327/2 "2016-07-13T05:38:41Z")

</div>

> I am trying to parse through log files that are separated by a row of dashes before and after each log \> file condensed into one document. I was thinking of creating a custom grok pattern and putting in patterns\_dir. And then using the multiline filter to read up to a row of dashes, and set what =\> "previous"

> WOULD THIS WORK?

Yeah, probably.

> is there a way to create a custom grok pattern for a row of dashes?

Sure, why would that be different from any other grok pattern? But given how trivial the regexp is I see little point in storing it in a grok pattern.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:48am UTC](https://discuss.elastic.co/t/custom-logstash-grok-filters-pattern/55327/3 "2017-07-06T04:48:21Z")

</div>

Closed on July 6, 2017, 4:48am UTC