# Grok not breaking on matching first pattern
**URL:** https://discuss.elastic.co/t/grok-not-breaking-on-matching-first-pattern/148794
**Category:** Logstash
**Created:** [September 17, 2018, 9:01am UTC](https://discuss.elastic.co/t/grok-not-breaking-on-matching-first-pattern/148794 "2018-09-17T09:01:56Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@Varun\_Goyal](https://discuss.elastic.co/u/Varun_Goyal)
#### Post date: [September 17, 2018, 9:01am UTC](https://discuss.elastic.co/t/grok-not-breaking-on-matching-first-pattern/148794/1 "2018-09-17T09:01:56Z")
I am using grok to extract first line data.
For that i tried **GREEDYDATA** , also tried \ ***.** but it seems it matches last entity.
My input has multiline codec.
Input Field:
Content installed successfully on the client\r\n\r\nProduct: XYZ Iron ASDB List 14.0 RU1\r\nVersion: DEF.CurDefs\r\nLanguage: Languages\r\nMoniker: {AVSRR-92CD-4877-B26F-EE9FFB3C34E0}\r\nSequence: 180913050\r\nPublish Date: Thursday, September 13, 2018\r\nRevision: 050\r\n
Grok Filter:
grok {
break\_on\_match =\> true
```
match => { "FIELD_CONTAING_DATA" => "(?m)(?^(.*))" }
```
}
I have also tried GREEDYDATA.
I have also tried match =\> { "FIELD\_CONTAING\_DATA" =\> "(?m)(?^(.\*\r\n))"
Still the output is:
Content installed successfully on the client\r\n\r\nProduct: XYZ Iron ASDB List 14.0 RU1\r\nVersion: DEF.CurDefs\r\nLanguage: Languages\r\nMoniker: {AVSRR-92CD-4877-B26F-EE9FFB3C34E0}\r\nSequence: 180913050\r\nPublish Date: Thursday, September 13, 2018\r\nRevision: 050\r\n
While, I was expecting output to be:
Content installed successfully on the client\r\n.
What I am missing here, can anyone help ?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 15, 2018, 9:01am UTC](https://discuss.elastic.co/t/grok-not-breaking-on-matching-first-pattern/148794/2 "2018-10-15T09:01:57Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.