# Grok Pattern for Handling and merging different log formats in the same file

**URL:** https://discuss.elastic.co/t/grok-pattern-for-handling-and-merging-different-log-formats-in-the-same-file/49670
**Category:** Logstash
**Created:** [May 10, 2016, 2:38pm UTC](https://discuss.elastic.co/t/grok-pattern-for-handling-and-merging-different-log-formats-in-the-same-file/49670 "2016-05-10T14:38:57Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![shubham\_deodia](https://avatars.discourse-cdn.com/v4/letter/s/a8b319/32.png) [@shubham\_deodia](https://discuss.elastic.co/u/shubham_deodia)
#### Post date: [May 10, 2016, 2:38pm UTC](https://discuss.elastic.co/t/grok-pattern-for-handling-and-merging-different-log-formats-in-the-same-file/49670/1 "2016-05-10T14:38:57Z")

</div>

Hi,

I am trying to create a GROK filter that will handle different type of logtype and merge the log for java stacktrace exception.

Like i am having a below two log type

1. Log with Message type

> 20160509 115807 I SD 0003 Designed for SysAdmins, Operations staff, Developers and DevOps who want to deploy the Elasticsearch, Logstash & Kibana (ELK) log management solution.

1. Log with Java Stacktrace exception

> 20160509 115111 E ------ ---- RemoteTrapSender.initTrapPersistence: java.io.IOException: Scratchpad read failure (java.io.EOFException)  
> 20160509 115111 E ------ ---- RemoteTrapSender.initTrapPersistence: at Util.Scratchpad$UnderlyingFile.read(Scratchpad.java:861)

Currently i am using the below filter, which do decent job of identifying the first log type

```
filter 
	{
		if [type] == "log"
		{
			grok
			{
				patterns_dir => "D:/Logstash/patterns"
				match => ["message", "% {YEAR:Year}%{MONTHNUM:Month}%{MONTHDAY:Day} %{HOUR:Hour}%{MINUTE:Minute}%{SECOND:Second} %{LOGLEVEL:LogVerbosity} %{WORD:MODULE}%{SPACE}%{BASE10NUM:MODULEID} %{GREEDYDATA:message}"]
             }
}

```

I am trying to create a filter which will differentiate the logs and it will merge Java Stacktrace exception log and display as one.

I know for merging we can use **multiline** codec. But, i am finding it ambiguous to use.

Could someone please guide to the right direction on this.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:58am UTC](https://discuss.elastic.co/t/grok-pattern-for-handling-and-merging-different-log-formats-in-the-same-file/49670/2 "2017-07-06T04:58:14Z")

</div>