# Grok Filter does not work with a newLine

**URL:** <https://discuss.elastic.co/t/grok-filter-does-not-work-with-a-newline/38951>\
**Category:** Logstash\
**Created:** [January 12, 2016, 8:27am UTC](https://discuss.elastic.co/t/grok-filter-does-not-work-with-a-newline/38951 "2016-01-12T08:27:02Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![golauty](https://avatars.discourse-cdn.com/v4/letter/g/eada6e/32.png) [@golauty](https://discuss.elastic.co/u/golauty)\
**Post date:** [January 12, 2016, 8:27am UTC](https://discuss.elastic.co/t/grok-filter-does-not-work-with-a-newline/38951/1 "2016-01-12T08:27:02Z")

</div>

I have following event in Logstash:

`"message": "[The variable 'number' was not bound while trying to expand attribute 'text' with value '$(value)'.]\n2016-01-12 08:30:09,983 [exec][TestCase] <Create a Product and open richtext editor [Error] [Warnings: 10] [Errors: 0] [Exceptions: 1]"`

Now i want to filter this message with:

`match => { "message[0]" => "(\[%{GREEDYDATA:ErrorMessage}\]\n+)?%{TIMESTAMP_ISO8601:incidentTime:date}\s+\[exec\]\[%{WORD:TestNode}\]\s*\<%{GREEDYDATA:test}\s*\[%{WORD:result}\]\s*\[Warnings: %{WORD:WarningCount}\](\s*\[Errors: %{WORD:ErrorCount}\]\s*\[Exceptions: %{WORD:ExceptionCount}\])?" }`  
And now i get a grokeparsefailure\_ and i don´t understand why? Without the error Message everything works fine.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 12, 2016, 9:07am UTC](https://discuss.elastic.co/t/grok-filter-does-not-work-with-a-newline/38951/2 "2016-01-12T09:07:57Z")

</div>

I think newline characters by default count as end-of-line, in which case prepending "(?m)" to the expression should help.

---

<div class="post-metadata">

**Author:** ![golauty](https://avatars.discourse-cdn.com/v4/letter/g/eada6e/32.png) [@golauty](https://discuss.elastic.co/u/golauty)\
**Post date:** [January 12, 2016, 9:49am UTC](https://discuss.elastic.co/t/grok-filter-does-not-work-with-a-newline/38951/3 "2016-01-12T09:49:13Z")

</div>

Where do I have to place that modifier, i placed it before the reg exp but that didn´t work ?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 12, 2016, 10:11am UTC](https://discuss.elastic.co/t/grok-filter-does-not-work-with-a-newline/38951/4 "2016-01-12T10:11:55Z")

</div>

Hmm. In that case I don't know what's up.

---

<div class="post-metadata">

**Author:** ![golauty](https://avatars.discourse-cdn.com/v4/letter/g/eada6e/32.png) [@golauty](https://discuss.elastic.co/u/golauty)\
**Post date:** [January 12, 2016, 11:50am UTC](https://discuss.elastic.co/t/grok-filter-does-not-work-with-a-newline/38951/5 "2016-01-12T11:50:25Z")

</div>

Is there something i can do to further investigate my error, like an enhanced log message? Maybe it is a bug....

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:16am UTC](https://discuss.elastic.co/t/grok-filter-does-not-work-with-a-newline/38951/6 "2017-07-06T05:16:03Z")

</div>

Closed on July 6, 2017, 5:16am UTC