# Grok pattern to read the testname in a multiline logfile

**URL:** <https://discuss.elastic.co/t/grok-pattern-to-read-the-testname-in-a-multiline-logfile/63248>\
**Category:** Logstash\
**Created:** [October 18, 2016, 6:03am UTC](https://discuss.elastic.co/t/grok-pattern-to-read-the-testname-in-a-multiline-logfile/63248 "2016-10-18T06:03:49Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![sharath3185](https://avatars.discourse-cdn.com/v4/letter/s/2bfe46/32.png) [@sharath3185](https://discuss.elastic.co/u/sharath3185)\
**Post date:** [October 18, 2016, 6:03am UTC](https://discuss.elastic.co/t/grok-pattern-to-read-the-testname-in-a-multiline-logfile/63248/1 "2016-10-18T06:03:49Z")

</div>

Hi I am trying to fetch the testnames from a multiline logfile using logstash.  
Below is the sample:

[testname1.sh](http://testname1.sh)  
DH no  
TIMESTAMP 1454774186  
LASTSTATION xxx  
LASTPASS 1454774186  
PASSNUM 1500  
PASSSTATION xxx  
TESTDURATION 286  
TIMESRUN 1500  
STATUS PASSED

[testname2.sh](http://testname2.sh)  
TIMESTAMP 1454775151  
LASTSTATION xxx  
LASTPASS 1454775151  
PASSNUM 1498  
PASSSTATION xxx  
TESTDURATION 229  
TIMESRUN 1498  
STATUS PASSED

[testname3.sh](http://testname3.sh)  
DH no  
PRIORITY HIGH  
LASTPASS 1454567890  
PASSNUM 1483  
PASSSTATION xxx  
TESTDURATION 33796  
TIMESRUN 1483  
TIMESTAMP 1454771355  
STATUS RUNNING  
LASTSTATION yyy

I need to extract [testname1.sh](http://testname1.sh), [testnam2.sh](http://testnam2.sh) and [testname3.sh](http://testname3.sh) and index it into 1 document in Elasticsearch

I tried different patterns , but nothing seems to be working  
Few things i tried  
grok  
{  
match =\> [  
"message", "%{GREEDYDATA:testname}.sh"  
]  
}

Also, I tried usng multiline filter to read compelte file with the below pattern  
multiline {  
pattern =\> "/.\*./gm"  
negate =\> true  
what =\> "previous"  
}  
and tried to use the .sh string, but did not work

COuld someone please help me out on how to retrieve the testnames from the above sample?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 20, 2016, 7:45pm UTC](https://discuss.elastic.co/t/grok-pattern-to-read-the-testname-in-a-multiline-logfile/63248/2 "2016-10-20T19:45:23Z")

</div>

> pattern =\> "/.\*./gm"

This searches for lines that literally begin with "/" and end with "/gm". Try replacing it with `^$`, expressing "if the line isn't empty, join with the previous line".

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:33am UTC](https://discuss.elastic.co/t/grok-pattern-to-read-the-testname-in-a-multiline-logfile/63248/3 "2017-07-06T04:33:22Z")

</div>