# Grok : Extract multiple lines format occurring between two lines of log data

**URL:** https://discuss.elastic.co/t/grok-extract-multiple-lines-format-occurring-between-two-lines-of-log-data/148962
**Category:** Logstash
**Created:** [September 18, 2018, 10:49am UTC](https://discuss.elastic.co/t/grok-extract-multiple-lines-format-occurring-between-two-lines-of-log-data/148962 "2018-09-18T10:49:47Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![ramindia](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ramindia/32/32459_2.png) [@ramindia](https://discuss.elastic.co/u/ramindia)
#### Post date: [September 21, 2018, 9:21pm UTC](https://discuss.elastic.co/t/grok-extract-multiple-lines-format-occurring-between-two-lines-of-log-data/148962/2 "2018-09-21T21:21:04Z")

</div>

i did some work same  
have a look this thread

> [@How many matches, we can have in grok filter - as example below](https://discuss.elastic.co/t/how-many-matches-we-can-have-in-grok-filter-as-example-below/148415):
>
> I have assorted logs coming to syslog file as one all.log, i am looking sort using different grok match, is this possible as below : match ? input { file { path =\> "/var/syslog-ng/raw/\*.log" start\_position =\> "beginning" type =\> "logstash-syslog" tags =\> ["logstash-syslog"] } } filter { grok { match =\> { [ "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{HOSTNAME:device\_src} %{NUMBER} %{SYSLOGTIMESTAMP} %{WORD}: %{GREEDYDATA:syslog\_message}", …

is this what you looking ?

---

_[View the full topic](https://discuss.elastic.co/t/grok-extract-multiple-lines-format-occurring-between-two-lines-of-log-data/148962)._