# Grok multi-line mode

**URL:** <https://discuss.elastic.co/t/grok-multi-line-mode/335101>\
**Category:** Logstash\
**Created:** [June 2, 2023, 3:44pm UTC](https://discuss.elastic.co/t/grok-multi-line-mode/335101 "2023-06-02T15:44:20Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![M\_D](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/m_d/32/117765_2.png) [@M\_D](https://discuss.elastic.co/u/M_D)\
**Post date:** [June 2, 2023, 3:44pm UTC](https://discuss.elastic.co/t/grok-multi-line-mode/335101/1 "2023-06-02T15:44:20Z")

</div>

I am using `(?ms)` in my grok filter, but got an error (see [RegexpError: undefined](https://discuss.elastic.co/t/regexperror-undefined/334714)).  
What should be the right way to lookup multiple lines using grok? in regular regex i amd doing

```auto
(?sm)(?<starttime>[0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}.[0-9]{3} |[A-Z][a-z]{2}\s[0-9]{2},\s[0-9]{4}\s[0-9]{2}:[0-9]{2}:[0-9]{2}\s(AM|PM)|)
(\s|)(?<loglevel>[A-Z]{4,6})(\s|)(?<service>)(\s|)
(?<data>\s(.*?)(?=[\r\n]+\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}|\Z))

```

---

<div class="post-metadata">

**Author:** ![Sunile\_Manjee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sunile_manjee/32/111461_2.png) [@Sunile\_Manjee](https://discuss.elastic.co/u/Sunile_Manjee)\
**Post date:** [June 3, 2023, 4:31pm UTC](https://discuss.elastic.co/t/grok-multi-line-mode/335101/2 "2023-06-03T16:31:23Z")

</div>

can you provide a sample input and your expected output?

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [June 4, 2023, 2:10pm UTC](https://discuss.elastic.co/t/grok-multi-line-mode/335101/3 "2023-06-04T14:10:33Z")

</div>

Multiline should start with `(?m)`, without _s_. You can use [grok patterns](https://github.com/logstash-plugins/logstash-patterns-core/blob/main/patterns/ecs-v1/grok-patterns).

> The syntax for a grok pattern is `%{SYNTAX:SEMANTIC}`  
> The `SYNTAX` is the name of the pattern that will match your text.

As Sunile already asked, a sample please

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [June 4, 2023, 2:16pm UTC](https://discuss.elastic.co/t/grok-multi-line-mode/335101/4 "2023-06-04T14:16:39Z")

</div>

Also [the blog article](https://www.elastic.co/blog/slow-and-steady-how-to-build-custom-grok-patterns-incrementally) might be useful for grok patterns.

---

<div class="post-metadata">

**Author:** ![M\_D](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/m_d/32/117765_2.png) [@M\_D](https://discuss.elastic.co/u/M_D)\
**Post date:** [June 6, 2023, 1:43pm UTC](https://discuss.elastic.co/t/grok-multi-line-mode/335101/5 "2023-06-06T13:43:12Z")

</div>

this is an example of the log

```auto
2010-06-19 02:26:05,556 INFO [main] [${sys:switchMode}] onEntry/onExit: com.example.wsw on Port [0]
2010-07-23 14:58:47,579 DEBUG [main] [${sys:switchMode}]
  c.a.s.c.ClickerController:
  {POST [/api/devices/clicker/{portIndex}/move-clicker]}: moveClicker(int,Map)
  {GET [/api/devices/clicker]}: Clickers()
  {UPDATE [/api/devices/clicker/{portIndex}/move-clicker]}: moveClicker(int,Map)
  {DELETE [/api/devices/clicker]}: Clickers()
2010-07-23 14:58:47,579 DEBUG [main] [${sys:switchMode}]
  c.a.s.c.ClickerController:
  {POST [/api/devices/clicker/{portIndex}/move-clicker]}: moveClicker(int,Map)
  {GET [/api/devices/clicker]}: Clickers()
  (WeirdLocalDataInspector)

```

---

<div class="post-metadata">

**Author:** ![M\_D](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/m_d/32/117765_2.png) [@M\_D](https://discuss.elastic.co/u/M_D)\
**Post date:** [June 6, 2023, 1:45pm UTC](https://discuss.elastic.co/t/grok-multi-line-mode/335101/6 "2023-06-06T13:45:46Z")

</div>

still failed to catch multiline. is it possible to give an example with my log?

```auto
2010-06-19 02:26:05,556 INFO [main] [${sys:switchMode}] onEntry/onExit: com.example.wsw on Port [0]
2010-07-23 14:58:47,579 DEBUG [main] [${sys:switchMode}]
  c.a.s.c.ClickerController:
  {POST [/api/devices/clicker/{portIndex}/move-clicker]}: moveClicker(int,Map)
  {GET [/api/devices/clicker]}: Clickers()
  {UPDATE [/api/devices/clicker/{portIndex}/move-clicker]}: moveClicker(int,Map)
  {DELETE [/api/devices/clicker]}: Clickers()
2010-07-23 14:58:47,579 DEBUG [main] [${sys:switchMode}]
  c.a.s.c.ClickerController:
  {POST [/api/devices/clicker/{portIndex}/move-clicker]}: moveClicker(int,Map)
  {GET [/api/devices/clicker]}: Clickers()
  (WeirdLocalDataInspector)

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 6, 2023, 6:45pm UTC](https://discuss.elastic.co/t/grok-multi-line-mode/335101/7 "2023-06-06T18:45:30Z")

</div>

What does one of your multi-line events look like if you use

```
output { stdout { codec => rubydebug } }

```

Are you using a multiline codec to combine all the lines from a single log entry into one event?

---

<div class="post-metadata">

**Author:** ![M\_D](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/m_d/32/117765_2.png) [@M\_D](https://discuss.elastic.co/u/M_D)\
**Post date:** [June 6, 2023, 7:44pm UTC](https://discuss.elastic.co/t/grok-multi-line-mode/335101/8 "2023-06-06T19:44:27Z")

</div>

sorry for the late response. I did not know about `codec =>mutline`. I was able to read multiple line using

```auto
input {
    file {
        path => "/usr/logs/*.log"
        codec => multiline {
            pattern => "^%{TIMESTAMP_ISO8601}"
            negate => true
            what => "previous"
        }
    }
}

```

Adding this here in case someone from the future sees this

> **[Multiline codec plugin | Logstash Reference \[8.8\] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-codecs-multiline.html)**

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 4, 2023, 7:45pm UTC](https://discuss.elastic.co/t/grok-multi-line-mode/335101/9 "2023-07-04T19:45:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.