# Deleting post

**URL:** https://discuss.elastic.co/t/deleting-post/92854
**Category:** Logstash
**Created:** [July 12, 2017, 6:08pm UTC](https://discuss.elastic.co/t/deleting-post/92854 "2017-07-12T18:08:33Z")
**Posts on this page:** 8
**Page:** 1

<div class="post-metadata">

### Author: ![amruth](https://avatars.discourse-cdn.com/v4/letter/a/43a26b/32.png) [@amruth](https://discuss.elastic.co/u/amruth)
#### Post date: [July 12, 2017, 6:08pm UTC](https://discuss.elastic.co/t/deleting-post/92854/1 "2017-07-12T18:08:33Z")

</div>

Deleting this post

---

<div class="post-metadata">

### Author: ![amruth](https://avatars.discourse-cdn.com/v4/letter/a/43a26b/32.png) [@amruth](https://discuss.elastic.co/u/amruth)
#### Post date: [July 13, 2017, 11:37am UTC](https://discuss.elastic.co/t/deleting-post/92854/2 "2017-07-13T11:37:03Z")

</div>

Any update on this please...

---

<div class="post-metadata">

### Author: ![Leandro\_Sampaio](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandro_sampaio/32/18409_2.png) [@Leandro\_Sampaio](https://discuss.elastic.co/u/Leandro_Sampaio)
#### Post date: [July 13, 2017, 12:03pm UTC](https://discuss.elastic.co/t/deleting-post/92854/3 "2017-07-13T12:03:09Z")

</div>

To multi line ... The better solution is filebeat/logshash.

Basically use o filebeat to filter the content e grok patterns to attribute fields

---

<div class="post-metadata">

### Author: ![amruth](https://avatars.discourse-cdn.com/v4/letter/a/43a26b/32.png) [@amruth](https://discuss.elastic.co/u/amruth)
#### Post date: [July 13, 2017, 12:42pm UTC](https://discuss.elastic.co/t/deleting-post/92854/4 "2017-07-13T12:42:45Z")

</div>

Hi Leandro,

I am using multiline plugin in logstash. I am not able to come up with a pattern which matches logs. Basically I am looking to extract highlighted fields above. I don't have any idea how to come up with a pattern to extract those fields.

---

<div class="post-metadata">

### Author: ![pts0](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pts0/32/17811_2.png) [@pts0](https://discuss.elastic.co/u/pts0)
#### Post date: [July 13, 2017, 12:56pm UTC](https://discuss.elastic.co/t/deleting-post/92854/5 "2017-07-13T12:56:02Z")

</div>

Hi,

Have a try with multilne pluging to get all messages:

```
file {
    codec => multiline {
      pattern => "^Query ended"
      negate => true
      what => previous
    }

```

and then with filter you extract data you need.

pts0

---

<div class="post-metadata">

### Author: ![amruth](https://avatars.discourse-cdn.com/v4/letter/a/43a26b/32.png) [@amruth](https://discuss.elastic.co/u/amruth)
#### Post date: [July 13, 2017, 2:05pm UTC](https://discuss.elastic.co/t/deleting-post/92854/6 "2017-07-13T14:05:48Z")

</div>

Deleting post

---

<div class="post-metadata">

### Author: ![amruth](https://avatars.discourse-cdn.com/v4/letter/a/43a26b/32.png) [@amruth](https://discuss.elastic.co/u/amruth)
#### Post date: [July 13, 2017, 4:10pm UTC](https://discuss.elastic.co/t/deleting-post/92854/7 "2017-07-13T16:10:57Z")

</div>

Is there any other plugin that can be used to extract required fields? I think using Grok, we have to give exact match for logs. In my case logs are too large. Please suggest me the best way.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 10, 2017, 4:11pm UTC](https://discuss.elastic.co/t/deleting-post/92854/8 "2017-08-10T16:11:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.