# Extract only one line of message in logstash

**URL:** <https://discuss.elastic.co/t/extract-only-one-line-of-message-in-logstash/209146>\
**Category:** Logstash\
**Created:** [November 23, 2019, 8:25am UTC](https://discuss.elastic.co/t/extract-only-one-line-of-message-in-logstash/209146 "2019-11-23T08:25:38Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![shrikantgulia](https://avatars.discourse-cdn.com/v4/letter/s/c68b51/32.png) [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)\
**Post date:** [November 23, 2019, 8:25am UTC](https://discuss.elastic.co/t/extract-only-one-line-of-message-in-logstash/209146/1 "2019-11-23T08:25:38Z")

</div>

Hello,

I have a message that is in the format

2019-10-22 22:59:56 HOSTNAME [Error] Connection id ""ABCDEF"", Request id ""123ABCD"": An unhandled exception was thrown by the application.  
System.NullReferenceException: Object reference not set to an instance of an object.  
at Moe.MicroservicesControllers.ApplicationsController.Get(String userId) in ne 26  
at Microsoft.AspNetCore.Mvc.Internal.ActionMethodExecutor.TaskOfIActionResultExecutor.Execute(

Now I want to extract only first line of the message my Logstash Configuration is

input {  
beats {  
port =\> 5044  
}  
}  
filter {  
grok {  
match =\> {"message" =\> "%{TIMESTAMP\_ISO8601:eventtime}\s\*(?[\w\d]+)\s\*[%{WORD:loglevel}]\s(?[\d\w\s"\n.@;():,$\>\<`-&\'|='?]+)"}  
}  
grok {  
match =\> [  
"eventdescription", "(?[\d\w\s"\n.@;():,$\>\<`-&\'|='?]+)._user\s"%{INT:user}(?[\d\w\s"\n.@;():,$\>\<`-&\[]'|='?]+)",  
"eventdescription", ".user\s"(?[\w\d-]+)",  
"eventdescription", ".User\s"%{INT:user}",  
"eventdescription", ".Connection\sid\s_""(?[\d\w]+)",  
"eventdescription", "._Request\s_id\s\*""(?[\d\w:]+)",  
"eventdescription", "(?[\d\w\s"\n.@;():,$\>\<`-&\'|='?]+)"  
]  
}  
if "multiline" in [log][flags]{  
mutate {  
add\_field =\> {"errormessage" =\> "%{eventdescription}"}  
}  
mutate {  
split =\> { "errormessage" =\> "\n" }  
mutate {  
replace =\> { "errormessage" =\> "%{errormessage[0]}" }  
}  
}  
}  
output {  
elasticsearch {  
hosts =\> ["localhost:9200"]  
index =\> "test3"  
}  
}

But I am not able to capture first line of the logs  
Please guide me

Regards

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 21, 2019, 8:25am UTC](https://discuss.elastic.co/t/extract-only-one-line-of-message-in-logstash/209146/2 "2019-12-21T08:25:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.