# Extracting data from multiline error message

**URL:** <https://discuss.elastic.co/t/extracting-data-from-multiline-error-message/233935>\
**Category:** Logstash\
**Created:** [May 22, 2020, 4:59pm UTC](https://discuss.elastic.co/t/extracting-data-from-multiline-error-message/233935 "2020-05-22T16:59:22Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![guas5](https://avatars.discourse-cdn.com/v4/letter/g/977dab/32.png) [@guas5](https://discuss.elastic.co/u/guas5)\
**Post date:** [May 22, 2020, 4:59pm UTC](https://discuss.elastic.co/t/extracting-data-from-multiline-error-message/233935/1 "2020-05-22T16:59:22Z")

</div>

Hello everyone,

would be very gratefull for a hint. I have a multiline message and I need to extract some info from multiline error (Producer.scala:77): one column Producer.scala and the next one is number of error (77). What would be the best and reliable way to do that: 1) since it comes as one multiline message, define GROK pattern for each incoming line separated by \n. But since the number of lines varies, I get grokparsefailure. 2) using IF condition, but it still needs a valid GROK pattern. Are there any other options how to do that?

Thanks for your help!!  
[Kafka|690x167](https://discuss.elastic.co/uploads/short-url/znbDsew4rQGOzcf1yR7iBk7ObcH.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 19, 2020, 4:59pm UTC](https://discuss.elastic.co/t/extracting-data-from-multiline-error-message/233935/2 "2020-06-19T16:59:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.