# Duplicated message in document, grok pattern problem

**URL:** <https://discuss.elastic.co/t/duplicated-message-in-document-grok-pattern-problem/298704>\
**Category:** Logstash\
**Created:** [March 3, 2022, 6:45am UTC](https://discuss.elastic.co/t/duplicated-message-in-document-grok-pattern-problem/298704 "2022-03-03T06:45:47Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![d.silwon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/d.silwon/32/65853_2.png) [@d.silwon](https://discuss.elastic.co/u/d.silwon)\
**Post date:** [March 3, 2022, 6:45am UTC](https://discuss.elastic.co/t/duplicated-message-in-document-grok-pattern-problem/298704/1 "2022-03-03T06:45:47Z")

</div>

Dears,

Please help me with parsing such multiline log, example one event:

```auto
2022-03-03 07:34:45.971 TRACE 865 --- [nio-5010-exec-7] rest-server :
Request {
    correlationId = a835e742-635a-43a6-8ea6-b406143e922b
    httpMethod = GET
    path = /v1/manage/system/health
    headers = [accept:"application/json, application/*+json", user-agent:"Java/11.0.14", host:"192.168.10.38:5010", connection:"keep-alive"]
    payload = N/A
}

```

Grok pattern in Logstash looks like this one:

```auto
  if "mlog" in [tags] {
    grok {
      match => ["message", "%{YEAR:year}-%{MONTHNUM:month}-%{MONTHDAY:day} %{TIME:time} %{GREEDYDATA:json_data}"]
    }
  }

```

and document in Elasticsearch looks like this one:

```auto
2022-03-03 07:34:45.971 TRACE 865 --- [nio-5010-exec-7] rest-server : 
Request {
    correlationId = a835e742-635a-43a6-8ea6-b406143e922b
    httpMethod = GET
    path = /v1/manage/system/health
    headers = [accept:"application/json, application/*+json", user-agent:"Java/11.0.14", host:"192.168.10.38:5010", connection:"keep-alive"]
    payload = N/A
}TRACE 865 --- [nio-5010-exec-7] rest-server : 
Request {
    correlationId = a835e742-635a-43a6-8ea6-b406143e922b
    httpMethod = GET
    path = /v1/manage/system/health
    headers = [accept:"application/json, application/*+json", user-agent:"Java/11.0.14", host:"192.168.10.38:5010", connection:"keep-alive"]
    payload =

```

Any idea how to solve it?

Best Regards,  
Dan

---

<div class="post-metadata">

**Author:** ![d.silwon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/d.silwon/32/65853_2.png) [@d.silwon](https://discuss.elastic.co/u/d.silwon)\
**Post date:** [March 3, 2022, 9:25am UTC](https://discuss.elastic.co/t/duplicated-message-in-document-grok-pattern-problem/298704/2 "2022-03-03T09:25:17Z")

</div>

It should solve parsing problem with multiline event:

```auto
%{YEAR:year}-%{MONTHNUM:month}-%{MONTHDAY:day} %{TIME:time} %{LOGLEVEL:logLevel} %{GREEDYDATA:log_header}\n(?m)%{GREEDYDATA:log_body}

```

Thanks a lot.

---

<div class="post-metadata">

**Author:** ![d.silwon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/d.silwon/32/65853_2.png) [@d.silwon](https://discuss.elastic.co/u/d.silwon)\
**Post date:** [March 3, 2022, 9:40am UTC](https://discuss.elastic.co/t/duplicated-message-in-document-grok-pattern-problem/298704/3 "2022-03-03T09:40:13Z")

</div>

If you have any better solution please describe it. Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 31, 2022, 9:40am UTC](https://discuss.elastic.co/t/duplicated-message-in-document-grok-pattern-problem/298704/4 "2022-03-31T09:40:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.