# GROK filter for multi-line Postgresql log **URL:** \ **Category:** Logstash\ **Created:** [January 22, 2016, 9:12am UTC](https://discuss.elastic.co/t/grok-filter-for-multi-line-postgresql-log/39854 "2016-01-22T09:12:33Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![EugeneBorshch](https://avatars.discourse-cdn.com/v4/letter/e/ecccb3/32.png) [@EugeneBorshch](https://discuss.elastic.co/u/EugeneBorshch)\ **Post date:** [January 22, 2016, 9:12am UTC](https://discuss.elastic.co/t/grok-filter-for-multi-line-postgresql-log/39854/1 "2016-01-22T09:12:33Z")
Hi All, I am having hard times trying to merge multi-line Postgresql logs with GROK into one Logstash event. My log file look like this: > Jan 22 09:45:01 myhost postgres[19015]: [2-1] postgres postgres 19015 ::1 ERROR: column "procpid" does not exist at character 8 > Jan 22 09:45:01 myhost postgres[19015]: [2-2] postgres postgres 19015 ::1 STATEMENT: select procpid,backend\_start,xact\_start,pg\_terminate\_backend(procpid) > Jan 22 09:45:01 myhost postgres[19015]: [2-3] #011 from pg\_stat\_activity > Jan 22 09:45:01 myhost postgres[19015]: [2-4] #011 where procpid \<\> pg\_backend\_pid() and > Jan 22 09:45:01 myhost postgres[19015]: [2-5] #011 text(client\_addr) not like '172.16.20.%' and > Jan 22 09:45:01 myhost postgres[19015]: [2-6] #011 text(client\_addr) not like '172.16.21.%' and > Jan 22 09:45:01 myhost postgres[19015]: [2-7] #011 extract(epoch from (now() - backend\_start)) \> 60 \* 60 \* 2; I'm trying to merge all parts (i.e. from **[2-1]** to **[2-N]**) but it doesn't work for me and I'm wondering whether it is possible at all. I would appreciate if someone can share any hints or his experience on this. Thanks ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [January 23, 2016, 5:14pm UTC](https://discuss.elastic.co/t/grok-filter-for-multi-line-postgresql-log/39854/2 "2016-01-23T17:14:13Z")
What distinguishes the first or last event in a sequence that you want to combine? That the second number in the number group inside the brackets is 1 (one)? ---
**Author:** ![EugeneBorshch](https://avatars.discourse-cdn.com/v4/letter/e/ecccb3/32.png) [@EugeneBorshch](https://discuss.elastic.co/u/EugeneBorshch)\ **Post date:** [January 25, 2016, 4:51pm UTC](https://discuss.elastic.co/t/grok-filter-for-multi-line-postgresql-log/39854/3 "2016-01-25T16:51:07Z")
Yes, that would be a second number in a group. > ... [2- **1**] ... > ... [2- **2**] ... > ... [2- **3**] ... > ... [2- **4**] ... > ... [2- **5**] ... > ... [2- **6**] ... > ... [2- **7**] ... ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [January 25, 2016, 6:29pm UTC](https://discuss.elastic.co/t/grok-filter-for-multi-line-postgresql-log/39854/4 "2016-01-25T18:29:34Z")
A multiline codec/filter similar to ```auto multiline { pattern => "... \[\d+-1\]" # adjust pattern to be more exact negate => true what => "previous" } ``` should work; lines that aren't the first message in a group should be joined with the previous line. ---
**Author:** ![EugeneBorshch](https://avatars.discourse-cdn.com/v4/letter/e/ecccb3/32.png) [@EugeneBorshch](https://discuss.elastic.co/u/EugeneBorshch)\ **Post date:** [January 26, 2016, 6:34pm UTC](https://discuss.elastic.co/t/grok-filter-for-multi-line-postgresql-log/39854/5 "2016-01-26T18:34:56Z")
Cool! It works! Thanks a lot. One small question, is it possible to get rid of syslog prefixes of the joined events? What I mean is that currently I'm getting one big event message, like below, and I want to skip the parts in **bold** : > Jan 22 09:45:01 myhost postgres[19015]: [2-1] postgres postgres 19015 ::1 ERROR: column "procpid" does not exist at character 8 **Jan 22 09:45:01 myhost postgres[19015]: [2-2]** postgres postgres 19015 ::1 STATEMENT: select procpid,backend\_start,xact\_start,pg\_terminate\_backend(procpid) **Jan 22 09:45:01 myhost postgres[19015]: [2-3]** #011 from pg\_stat\_activity **Jan 22 09:45:01 myhost postgres[19015]: [2-4]** #011 where procpid \<\> pg\_backend\_pid() and **Jan 22 09:45:01 myhost postgres[19015]: [2-5]** #011 text(client\_addr) not like '172.16.20.%' and **Jan 22 09:45:01 myhost postgres[19015]: [2-6]** #011 text(client\_addr) not like '172.16.21.%' and **Jan 22 09:45:01 myhost postgres[19015]: [2-7]** #011 extract(epoch from (now() - backend\_start)) \> 60 \* 60 \* 2; ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [January 27, 2016, 7:19am UTC](https://discuss.elastic.co/t/grok-filter-for-multi-line-postgresql-log/39854/6 "2016-01-27T07:19:00Z")
Perhaps the mutate filter's gsub option can help you remove this? It's probably easier doing that first and then join lines together with a multiline filter. ---
**Author:** ![aregaieg](https://avatars.discourse-cdn.com/v4/letter/a/ba8739/32.png) [@aregaieg](https://discuss.elastic.co/u/aregaieg)\ **Post date:** [June 14, 2017, 8:54pm UTC](https://discuss.elastic.co/t/grok-filter-for-multi-line-postgresql-log/39854/7 "2017-06-14T20:54:26Z")
Hi Eugene, is it possible to post the grok or if you can your logstash config file to parse Postgresql log messages ? Thank you ---
**Author:** ![Luiz\_Siqueira](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/luiz_siqueira/32/28692_2.png) [@Luiz\_Siqueira](https://discuss.elastic.co/u/Luiz_Siqueira)\ **Post date:** [March 12, 2018, 2:52pm UTC](https://discuss.elastic.co/t/grok-filter-for-multi-line-postgresql-log/39854/8 "2018-03-12T14:52:47Z")
Eugene, good morning. Could you post your Grok solution to the Postgresql logs case, including the input and output area? I'm in the same situation. Thank you very much. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 4, 2022, 4:13am UTC](https://discuss.elastic.co/t/grok-filter-for-multi-line-postgresql-log/39854/9 "2022-11-04T04:13:17Z")