# Facing problem to break this log in grok pattern

**URL:** <https://discuss.elastic.co/t/facing-problem-to-break-this-log-in-grok-pattern/295305>\
**Category:** Logstash\
**Created:** [January 25, 2022, 6:20am UTC](https://discuss.elastic.co/t/facing-problem-to-break-this-log-in-grok-pattern/295305 "2022-01-25T06:20:59Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jannatnishat](https://avatars.discourse-cdn.com/v4/letter/j/5daacb/32.png) [@jannatnishat](https://discuss.elastic.co/u/jannatnishat)\
**Post date:** [January 25, 2022, 6:20am UTC](https://discuss.elastic.co/t/facing-problem-to-break-this-log-in-grok-pattern/295305/1 "2022-01-25T06:20:59Z")

</div>

=================== Start: 2022-01-23-16:44:04 ======================  
URL:[https://www.siikoytto.com/siikoytto/api/v5/selfcare/dpdp/get\_subscriptions](https://www.siikoytto.com/siikoytto/api/v5/selfcare/dpdp/get_subscriptions)  
Request:{"msisdn":"880139919"}  
Response:{"status":true,"message":"Success","services":}  
Custom Log:/app/selfcare/app/controllers/api/v5/selfcare/Dpdp.php  
{"statusInfo":{"statusCode":"500","referenceCode":"3037399192022012316440473","serverReferenceCode":"5520211171642934644846364","errorInfo":{"errorCode":"52031","errorDescription":"CRM API GATEWAY INTERNAL APPLICATION ERROR"}}}  
Headers:{"Content-Type":"application/json; charset=UTF-8","Host":"[www.siikoytto.com](http://www.siikoytto.com)","X-Real-Ip":"103.88.232.230","X-Forwarded-For":"104.89.232.230","X-Forwarded-Proto":"https","Content-Length":"26","X-Auth-Api-Key":"9430a9b315c8d8b5c713c6d635cbf66d","Accept-Encoding":"gzip","User-Agent":"okhttp/3.12.12"}  
============================ End ==============================

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 25, 2022, 5:02pm UTC](https://discuss.elastic.co/t/facing-problem-to-break-this-log-in-grok-pattern/295305/2 "2022-01-25T17:02:29Z")

</div>

I would use an array of pattern to pick out each line, like [this](https://discuss.elastic.co/t/issue-parsing-db2diag-log-using-grok-filter/281957/2) or [this](https://discuss.elastic.co/t/issue-parsing-db2diag-log-using-grok-filter/281957/2).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 22, 2022, 5:02pm UTC](https://discuss.elastic.co/t/facing-problem-to-break-this-log-in-grok-pattern/295305/3 "2022-02-22T17:02:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.