# Grok cant detect change of line

**URL:** <https://discuss.elastic.co/t/grok-cant-detect-change-of-line/255796>\
**Category:** Logstash\
**Created:** [November 18, 2020, 7:36am UTC](https://discuss.elastic.co/t/grok-cant-detect-change-of-line/255796 "2020-11-18T07:36:45Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Alexandros888](https://avatars.discourse-cdn.com/v4/letter/a/3ec8ea/32.png) [@Alexandros888](https://discuss.elastic.co/u/Alexandros888)\
**Post date:** [November 18, 2020, 7:36am UTC](https://discuss.elastic.co/t/grok-cant-detect-change-of-line/255796/1 "2020-11-18T07:36:45Z")

</div>

Hello all,

I have the following file that i want to grok:

```
AG	100045	1FB702 27.12.2011	675337068	ZFA31200000......
AG	100045 X	17.11.1961	084260332	5352...
AG	100046	1SF995 22.04.2016	217347660	TMBET6NH1G4......
AG	100047	1NA955 29.04.2016	679788553	JN1JCNT32U0......
AG	100048	1TA247 27.01.2005	327171306	VNKKL18370A......
AG	10005	6S7081 09.05.1997	416470418	VS52A112...
AG	100050 X	01.07.1962	084272310	5353...
AG	100051	1VE306 25.04.2013	215324011	WVWZZZ1KZDW......
AG	100052	1OB394 29.09.2010	599179460	W0L0AHL35A2......
AG	100054	1SC841 29.05.2020	683803741	JF1SKELL5LG......
AG	100055	1OB433 29.09.2011	599411768	W0L0SDL68B4......
AG	100056	385206	C	04.09.1974	045202240	1142581...
AG	100056	5189	M	01.05.1967	023215573	117655...

```

I use the following pattern:

```
filter {

      grok {
        match => { "message" => "%{DATA:1}\t%{DATA:2}\t%{DATA:3}\t%{DATA:4}\t%{DATA:5}\t%{DATA:6}\t%{DATA:7}" }
      }
    }

```

But every time it parses only the first line

 ![image1](https://us1.discourse-cdn.com/elastic/original/3X/0/5/058482bbdff58d7d46273043bbbb9de12ace0b22.png)

Basically, it ignores change of lines and i dont want that.

Any help please?

Thank you

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 16, 2020, 7:36am UTC](https://discuss.elastic.co/t/grok-cant-detect-change-of-line/255796/2 "2020-12-16T07:36:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.