# Grok pattern to match Filebeat multiline input up to the first new line character

**URL:** <https://discuss.elastic.co/t/grok-pattern-to-match-filebeat-multiline-input-up-to-the-first-new-line-character/253575>\
**Category:** Logstash\
**Created:** [October 28, 2020, 2:18pm UTC](https://discuss.elastic.co/t/grok-pattern-to-match-filebeat-multiline-input-up-to-the-first-new-line-character/253575 "2020-10-28T14:18:17Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![sjne](https://avatars.discourse-cdn.com/v4/letter/s/67e7ee/32.png) [@sjne](https://discuss.elastic.co/u/sjne)\
**Post date:** [October 28, 2020, 2:18pm UTC](https://discuss.elastic.co/t/grok-pattern-to-match-filebeat-multiline-input-up-to-the-first-new-line-character/253575/1 "2020-10-28T14:18:17Z")

</div>

Logstash 6.8.10  
Filebeat 6.8.9

Filebeat config:

```auto
filebeat.inputs:

- type: log
  enabled: true
  paths:
  - '/path/to/file'
  tags:
  - 'app'
  fields:
    app_id: some_app
  multiline.pattern: '^\[[0-9]{4}\-[0-9]{2}-[0-9]{2}'
  multiline.negate: true
  multiline.match: after

logging.level: info
logging.metrics.period: 10m
logging.to_files: true
logging.files:
  keepfiles: 4
  permissions: 0644

```

Filebeat is sending Logstash data with message fields like this:

```auto
"message": "[2020-10-28 15:27:24,646] ERROR - SomethingSomething.otherThing(SomethingSomething.java:85) - Exception while doing something\njava.lang.NullPointerException\notherMethodCalls"

```

Now, in my Logstash setup I'd like to parse everything up to the first new line character, basically just the first log line.

What I thought about using was this:

```auto
filter {
    grok {
        match => { "message" => "^\[%{TIMESTAMP_ISO8601:[@metadata][logtime]}\]%{SPACE}%{LOGLEVEL:level}%{SPACE}-%{SPACE}%{DATA:classInfo}%{SPACE}-%{SPACE}%{GREEDYDATA:[@metadata][messageBody]}$" }
    }
}

```

But this for some reason does not work:

```auto
{
  "classInfo": "SomethingSomething.otherThing(SomethingSomething.java:85)",
  "level": "ERROR",
  "[@metadata][logtime]": "2020-10-28 15:27:24,646",
  "[@metadata][messageBody]": "Exception while doing something\njava.lang.NullPointerException\notherMethodCalls"
}

```

Afaik GREEDYDATA should not match new line unless the `(?m)` flag is given. So what am I getting wrong here? Thanks!

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 28, 2020, 4:16pm UTC](https://discuss.elastic.co/t/grok-pattern-to-match-filebeat-multiline-input-up-to-the-first-new-line-character/253575/2 "2020-10-28T16:16:21Z")

</div>

Change GREEDYDATA to DATA and you will get

```
 "@metadata" => {
        "logtime" => "2020-10-28 15:27:24,646",
    "messageBody" => "Exception while doing something"
},
```

---

<div class="post-metadata">

**Author:** ![sjne](https://avatars.discourse-cdn.com/v4/letter/s/67e7ee/32.png) [@sjne](https://discuss.elastic.co/u/sjne)\
**Post date:** [October 28, 2020, 6:29pm UTC](https://discuss.elastic.co/t/grok-pattern-to-match-filebeat-multiline-input-up-to-the-first-new-line-character/253575/3 "2020-10-28T18:29:57Z")

</div>

Thanks! So GREEDYDATA does match newline (`\n`) by default? Regardless if I use the `(?m)` flag or not?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 28, 2020, 6:42pm UTC](https://discuss.elastic.co/t/grok-pattern-to-match-filebeat-multiline-input-up-to-the-first-new-line-character/253575/4 "2020-10-28T18:42:02Z")

</div>

It appears to, yes.

---

<div class="post-metadata">

**Author:** ![sjne](https://avatars.discourse-cdn.com/v4/letter/s/67e7ee/32.png) [@sjne](https://discuss.elastic.co/u/sjne)\
**Post date:** [October 28, 2020, 7:08pm UTC](https://discuss.elastic.co/t/grok-pattern-to-match-filebeat-multiline-input-up-to-the-first-new-line-character/253575/5 "2020-10-28T19:08:40Z")

</div>

Really odd since GREEDYDATA is `.*` I think and the Oniguruma regex docs say that `. any character (except newline)` ([link](https://github.com/kkos/oniguruma/blob/master/doc/RE#L48)).

---

<div class="post-metadata">

**Author:** ![sjne](https://avatars.discourse-cdn.com/v4/letter/s/67e7ee/32.png) [@sjne](https://discuss.elastic.co/u/sjne)\
**Post date:** [October 29, 2020, 12:35pm UTC](https://discuss.elastic.co/t/grok-pattern-to-match-filebeat-multiline-input-up-to-the-first-new-line-character/253575/6 "2020-10-29T12:35:57Z")

</div>

If anyone could point out if there is a default in Logstash where dot matches newlines, I'd be really thankful!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 26, 2020, 12:36pm UTC](https://discuss.elastic.co/t/grok-pattern-to-match-filebeat-multiline-input-up-to-the-first-new-line-character/253575/7 "2020-11-26T12:36:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.