# Greedydata not working as expected
**URL:** https://discuss.elastic.co/t/greedydata-not-working-as-expected/46972
**Category:** Logstash
**Created:** [April 11, 2016, 10:04am UTC](https://discuss.elastic.co/t/greedydata-not-working-as-expected/46972 "2016-04-11T10:04:11Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@Suren92](https://discuss.elastic.co/u/Suren92)
#### Post date: [April 11, 2016, 10:04am UTC](https://discuss.elastic.co/t/greedydata-not-working-as-expected/46972/1 "2016-04-11T10:04:11Z")
Hi,
I have the following data
2016-02-07 22:45:48,804 [72] FATAL GlobalHttpApplication [(null)] -
[Request url]: /?
[Reported Exception Message]: Server cannot set status after HTTP headers have been sent.
Region: (null)
UserId: (null)
Session: {}
System.Web.HttpException (0x80004005): Server cannot set status after HTTP headers have been sent.
at System.Web.HttpResponse.set\_StatusCode(Int32 value)
at System.Web.HttpResponseWrapper.set\_StatusCode(Int32 value)
at System.Web.Mvc.HandleErrorAttribute.OnException(ExceptionContext filterContext)
at System.Web.Mvc.ControllerActionInvoker.InvokeExceptionFilters(ControllerContext controllerContext, IList`1 filters, Exception exception)
at System.Web.Mvc.ControllerActionInvoker.InvokeAction(ControllerContext controllerContext, String actionName)
at System.Web.Mvc.Controller.ExecuteCore()
at System.Web.Mvc.ControllerBase.Execute(RequestContext requestContext)
at System.Web.Mvc.ControllerBase.System.Web.Mvc.IController.Execute(RequestContext requestContext)
at AdminWebsite.Controllers.ErrorController.InvokeErrorAction(HttpContextBase httpContext, String action, Exception exception) in d:\jenkins\build\hickory\rc-2.21.0\build-artifacts\workspace\src\App\AdminWebsite\Controllers\ErrorController.cs:line 77
at AdminWebsite.Global.Application\_Error(Object sender, EventArgs e) in d:\jenkins\build\hickory\rc-2.21.0\build-artifacts\workspace\src\App\AdminWebsite\Global.asax.cs:line 291
and the conf file is as below:
input
{
stdin{
codec =\> multiline {
pattern =\> "^%{TIMESTAMP\_ISO8601} "
what =\> previous
negate =\> true
}
}
}
filter
{
grok {
match =\> ["message", "%{TIMESTAMP\_ISO8601:log\_timestamp}[]_[%{GREEDYDATA:debugid}][]_%{LOGLEVEL:log\_level:WORD}[]_%{NOTSPACE:service}[]_._(null)._[]_-[]_ **%{GREEDYDATA:log\_details}**" ]
}
date {
match =\> ["log\_timestamp", "YYYY-MM-dd HH:mm:ss,SSS"]
target =\> log\_timestamp
locale =\> en
timezone =\> UCT
}
}
output
{
elasticsearch
{
hosts =\> "localhost:9200"
index =\> mydata
}
stdout
{
codec =\> rubydebug
}
}
The output I am getting is as below:
{ "@timestamp" =\> "2016-04-11T10:01:06.973Z",
"message" =\> "2016-02-07 22:45:48,804 [72] FATAL GlobalHttpApplication
[(null)] - [Request url]: /?[Reported Exception Message]: Server cannot set sta
tus after HTTP headers have been sent.\r\n Region: (null) \r\n UserId: (null) \r
\n Session: {} \r\n \r\nSystem.Web.HttpException (0x80004005): Server cannot set
status after HTTP headers have been sent.\r\n at System.Web.HttpResponse.set\_
StatusCode(Int32 value)\r\n at System.Web.HttpResponseWrapper.set\_StatusCode(I
nt32 value)\r\n at System.Web.Mvc.HandleErrorAttribute.OnException(ExceptionCo
ntext filterContext)\r\n at System.Web.Mvc.ControllerActionInvoker.InvokeExcep
tionFilters(ControllerContext controllerContext, IList`1 filters, Exception exce
ption)\r\n at System.Web.Mvc.ControllerActionInvoker.InvokeAction(ControllerCo
ntext controllerContext, String actionName)\r\n at System.Web.Mvc.Controller.E
xecuteCore()\r\n at System.Web.Mvc.ControllerBase.Execute(RequestContext reque
stContext)\r\n at System.Web.Mvc.ControllerBase.System.Web.Mvc.IController.Exe
cute(RequestContext requestContext)\r\n at AdminWebsite.Con
trollers.ErrorController.InvokeErrorAction(HttpContextBase httpContext, String a
ction, Exception exception) in d:\jenkins\build\hickory\rc-2.21.0\build-art
ifacts\workspace\src\App\AdminWebsite\Controllers\Error
Controller.cs:line 77\r\n at AdminWebsite.Global.Applicatio
n\_Error(Object sender, EventArgs e) in d:\jenkins\build\hickory\rc-2.21.0\b
uild-artifacts\workspace\src\App\AdminWebsite\Global.asa
x.cs:line 291\r",
"@version" =\> "1",
"tags" =\> [
[0] "multiline"
],
"host" =\> "ITT-Surendra",
"log\_timestamp" =\> "2016-02-07T22:45:48.804Z",
"debugid" =\> "72",
"log\_level" =\> "FATAL",
"service" =\> "GlobalHttpApplication",
**"log\_details" =\> "artifacts\workspace\src\App\AdminWebsite\Global.asax.cs:line 291\r"**
}
If you see the bold text, which is a greedy data, it is not taking all the data, I don't know what is the error. Everything else is working fine other than that. Can someone please help me to fix this?
Thanks,
---
### Author:  [@Alex\_6](https://discuss.elastic.co/u/Alex_6)
#### Post date: [April 11, 2016, 1:20pm UTC](https://discuss.elastic.co/t/greedydata-not-working-as-expected/46972/2 "2016-04-11T13:20:55Z")
Grok doesn't work across multiple lines i.e. when using a multiline codec/filter. Add `(?m)` to the start of your Grok pattern:
```
grok {
match => ["message", "(?m)%{TIMESTAMP_ISO8601:log_timestamp}[][%{GREEDYDATA:debugid}][]%{LOGLEVEL:log_level:WORD}[]%{NOTSPACE:service}[].(null).[]*-[] ***%{GREEDYDATA:log_details}**" ]
}
```
Does that fix it?
---
### Author:  [@Suren92](https://discuss.elastic.co/u/Suren92)
#### Post date: [April 12, 2016, 5:26am UTC](https://discuss.elastic.co/t/greedydata-not-working-as-expected/46972/3 "2016-04-12T05:26:18Z")
@Alex_6 : No, I am still getting the same output.
---
### Author:  [@Suren92](https://discuss.elastic.co/u/Suren92)
#### Post date: [April 12, 2016, 5:37am UTC](https://discuss.elastic.co/t/greedydata-not-working-as-expected/46972/4 "2016-04-12T05:37:43Z")
@Alex_6 is there any other way in which I can overcome this problem?
---
### Author:  [@Suren92](https://discuss.elastic.co/u/Suren92)
#### Post date: [April 12, 2016, 8:15am UTC](https://discuss.elastic.co/t/greedydata-not-working-as-expected/46972/5 "2016-04-12T08:15:00Z")
@Alex_6 , got it fixed, there was a problem in the grok pattern that's why I was facing the issue.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:02am UTC](https://discuss.elastic.co/t/greedydata-not-working-as-expected/46972/6 "2017-07-06T05:02:49Z")