# Grok - Skipping Line **URL:** \ **Category:** Logstash\ **Created:** [May 20, 2016, 10:33pm UTC](https://discuss.elastic.co/t/grok-skipping-line/50605 "2016-05-20T22:33:25Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![anil\_varghese](https://avatars.discourse-cdn.com/v4/letter/a/fbc32d/32.png) [@anil\_varghese](https://discuss.elastic.co/u/anil_varghese)\ **Post date:** [May 20, 2016, 10:33pm UTC](https://discuss.elastic.co/t/grok-skipping-line/50605/1 "2016-05-20T22:33:25Z")
Good Evening Everyone, I am a beginner in logstash. I was trying to parse a log file which have 159 lines in it. I am interested only in the first ,second and last line. Is there any way to skip or omit these lines with Grok ? Is there any other logstash plugins allow me to do this? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 21, 2016, 5:37pm UTC](https://discuss.elastic.co/t/grok-skipping-line/50605/2 "2016-05-21T17:37:55Z")
Do the lines you want to skip have any characteristics (content-wise) that set them apart from the three first lines? Perhaps you can give an example of the input file. (The grok filter itself won't help you to drop any events but the drop filter will.) ---
**Author:** ![anil\_varghese](https://avatars.discourse-cdn.com/v4/letter/a/fbc32d/32.png) [@anil\_varghese](https://discuss.elastic.co/u/anil_varghese)\ **Post date:** [May 24, 2016, 4:58pm UTC](https://discuss.elastic.co/t/grok-skipping-line/50605/3 "2016-05-24T16:58:29Z")
Magnus, The only thing that differentiate is that the first and last lines have 3 #s I am interested only in 1,6,and last line. I need the Job Start Time, End time and Job Name[Move\_File\_job] Please find the sample log attached: ### Job Started at 2016/05/17 11:45:07 (jxxIx=20160427\_171509\_pxPwP, jxxxxxxutixxIx=20160517114507\_txQxt) [stxtistixs] xxxxxxtixx tx sxxxxt xx pxrt 10849 [stxtistixs] xxxxxxtxx 001:Move\_File\_job: xxxix(Prxxuxtixx) TxxxxxPix:20160517114507\_txQxt RuxIx:xuxx 002:Jxx\_xxxx\_ix: Suxjxx hxs ixitixtx thx xx xpxx 001:xxxpxxxxtxxxsxs: xxxix(Prxxuxtixx) 002:xxxpxxxxtxxxsxs: Suxjxx hxs ixitixtx thx xx xpxx Usixx xxxxxxx : prxxuxtixx txxxtxxtxxxx\_1 sxt xxy "xrxxxxSxrvixxxxxx" with vxxux "xxPxxxP.xxxxxx.xxx.xxxxxx.xxt" txxxtxxtxxxx\_1 sxt xxy "xrxxxxUsxrxxxx" with vxxux "xxx\_xpxx" txxxtxxtxxxx\_1 sxt xxy "xrxxxxxxxitixxxxJxxxPxrxxxtxrs" with vxxux "xxxxuxtRxwPrxxxtxh=80000" sxt xxy "xrxxxxxxxitixxxxJxxxPxrxxxtxrs" with vxxux "xxxxuxtRxwPrxxxtxh=80000" txxxtxxtxxxx\_1 sxt xxy "xrxxxxSxhxxx" with vxxux " " txxxtxxtxxxx\_1 sxt xxy "xrxxxxHxst" with vxxux "xx01-sxxx.xxxxxx.xxx.xxxxxx.xxt" txxxtxxtxxxx\_1 sxt xxy "xrxxxxSxrvixxxxxx" with vxxux "xxPxxxP.xxxxxx.xxx.xxxxxx.xxt" txxxtxxtxxxx\_1 sxt xxy "xrxxxxPxsswxrx" with vxxux "xxrxxrt" txxxtxxtxxxx\_1 sxt xxy "xrxxxxUsxrxxxx" with vxxux "ixtxrxrxtixx" txxxtxxtxxxx\_1 sxt xxy "xrxxxxUsxrxxxx" with vxxux "xxrxxrt" txxxtxxtxxxx\_1 sxt xxy "xrxxxxSxhxxx" with vxxux " " txxxtxxtxxxx\_1 sxt xxy "xrxxxxSxrvixxxxxx" with vxxux "xxRxxRT.xxxxxx.xxx.xxxxxx.xxt" txxxtxxtxxxx\_1 sxt xxy "xrxxxxPxrt" with vxxux "1587" xrxxxxShxrxxxxxxxxtixx: xstxxxishixx shxrxx xxtxxxsx xxxxxxtixx xrxxxxxxxxpxxShxrxxxxxxxxtixx tx xxPxxxP.xxxxxx.xxx.xxxxxx.xxt xs xxx\_xpxx xrxxxxShxrxxxxxxxxtixx: xstxxxishixx shxrxx xxtxxxsx xxxxxxtixx xrxxxxxxxxxxxShxrxxxxxxxxtixx tx xxRxxRT.xxxxxx.xxx.xxxxxx.xxt xs xxrxxrt xrxxxxShxrxxxxxxxxtixx: xstxxxishixx shxrxx xxtxxxsx xxxxxxtixx xrxxxxIxtxxrxtixxShxrxxxxxxxxtixx tx xxPxxxP.xxxxxx.xxx.xxxxxx.xxt xs ixtxrxrxtixx xrxxxxShxrxxxxxxxxtixx: xstxxxishixx shxrxx xxtxxxsx xxxxxxtixx xrxxxxIxtxxrxtixxxxrShxrxxxxxxxxtixx tx xxRxxRT.xxxxxx.xxx.xxxxxx.xxt xs xxrxxrt xrxxxxShxrxxxxxxxxtixx: xxxxxxtixx xstxxxishxx xrxxxxShxrxxxxxxxxtixx: xxxxxxtixx xstxxxishxx xrxxxxShxrxxxxxxxxtixx: xxxxxxtixx xstxxxishxx xrxxxxShxrxxxxxxxxtixx: xxxxxxtixx xstxxxishxx xxxxxtxxtRxxxxr: xx xxxtxxt whxrx xxxusx : whxrx xxxtxxtStr='Prxxuxtixx' xxx xxxtxxtxxxx='xRxxxx\_xxx' txxxtxxtxxxx\_1 sxt xxy "xrxxxxSxrvixxxxxx" with vxxux "xxPxxxP.xxxxxx.xxx.xxxxxx.xxt" txxxtxxtxxxx\_1 sxt xxy "xrxxxxUsxrxxxx" with vxxux "xxx\_xpxx" txxxtxxtxxxx\_1 sxt xxy "xrxxxxxxxitixxxxJxxxPxrxxxtxrs" with vxxux "xxxxuxtRxwPrxxxtxh=80000" txxxtxxtxxxx\_1 sxt xxy "xrxxxxHxst" with vxxux "xx01-sxxx.xxxxxx.xxx.xxxxxx.xxt" txxxtxxtxxxx\_1 sxt xxy "xrxxxxPxsswxrx" with vxxux "xxxxxx" txxxtxxtxxxx\_1 sxt xxy "xrxxxxPxrt" with vxxux "1587" txxxtxxtxxxx\_1 sxt xxy "xrxxxxSxhxxx" with vxxux " " xrxxxxShxrxxxxxxxxtixx: xstxxxishixx shxrxx xxtxxxsx xxxxxxtixx xrxxxxxxxxxShxrxxxxxxxxtixx tx xxPxxxP.xxxxxx.xxx.xxxxxx.xxt xs xxx\_xpxx xrxxxxShxrxxxxxxxxtixx: xxxxxxtixx xstxxxishxx txxxtxxtxxxx\_1 sxt xxy "xrxxxxxxxitixxxxJxxxPxrxxxtxrs" with vxxux "xxxxuxtRxwPrxxxtxh=80000" txxxtxxtxxxx\_1 sxt xxy "xrxxxxHxst" with vxxux "xx01-sxxx.xxxxxx.xxx.xxxxxx.xxt" txxxtxxtxxxx\_1 sxt xxy "xrxxxxPxsswxrx" with vxxux "xPIzhxxISP" txxxtxxtxxxx\_1 sxt xxy "xrxxxxPxrt" with vxxux "1587" txxxtxxtxxxx\_1 sxt xxy "xrxxxxSxhxxx" with vxxux " " txxxtxxtxxxx\_1 sxt xxy "xrxxxxSxrvixxxxxx" with vxxux "xxPxxxP.xxxxxx.xxx.xxxxxx.xxt" txxxtxxtxxxx\_1 sxt xxy "xrxxxxUsxrxxxx" with vxxux "xxx\_xUxIT" xrxxxxShxrxxxxxxxxtixx: xstxxxishixx shxrxx xxtxxxsx xxxxxxtixx xrxxxxxxxxuxitShxrxxxxxxxxtixx tx xxPxxxP.xxxxxx.xxx.xxxxxx.xxt xs xxx\_xUxIT xrxxxxShxrxxxxxxxxtixx: xxxxxxtixx xstxxxishxx xxxxxtxxtRxxxxr: xx xxxtxxt whxrx xxxusx : whxrx xxxtxxtStr='Prxxuxtixx' xxx xxxtxxtxxxx='xRxxxx\_IxTxxRxTIxx\_xxStxxx' txxxtxxtxxxx\_1 sxt xxy "xrxxxxxxxitixxxxJxxxPxrxxxtxrs" with vxxux "xxxxuxtRxwPrxxxtxh=80000" txxxtxxtxxxx\_1 sxt xxy "xrxxxxHxst" with vxxux "xx01-sxxx.xxxxxx.xxx.xxxxxx.xxt" txxxtxxtxxxx\_1 sxt xxy "xrxxxxPxsswxrx" with vxxux "xxrxxrt" txxxtxxtxxxx\_1 sxt xxy "xrxxxxPxrt" with vxxux "1587" txxxtxxtxxxx\_1 sxt xxy "xrxxxxSxhxxx" with vxxux " " txxxtxxtxxxx\_1 sxt xxy "xrxxxxSxrvixxxxxx" with vxxux "xxxxxRT.xxxxxx.xxx.xxxxxx.xxt" txxxtxxtxxxx\_1 sxt xxy "xrxxxxUsxrxxxx" with vxxux "xxrxxrt" xrxxxxShxrxxxxxxxxtixx: xstxxxishixx shxrxx xxtxxxsx xxxxxxtixx xrxxxxxxStxxxShxrxxxxxxxxtixx t 001:xs\_Vxixxxsx\_IUx: xxxix(Prxxuxtixx) TxxxxxPix:20160517114507\_txQxt RuxIx:xuxx ### Job Ended Successfuxxy xt 2016/05/17 11:46:04 (jxxIx=20160427\_171509\_pxPwP, jxxxxxxutixxIx=20160517114507\_txQxt) ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 24, 2016, 8:23pm UTC](https://discuss.elastic.co/t/grok-skipping-line/50605/4 "2016-05-24T20:23:47Z")
This would've been much easier to grasp if you had formatted the log as code so that the "###" lines weren't formatted as section headers. Use a conditional to drop all lines not matching one of the patterns that you're interested in. Something like this should work: ```nohighlight filter { if [message] !~ /^(Job Started at|Job Ended |001: Move_File_Job: )/ { drop { } } } ``` ---
**Author:** ![anil\_varghese](https://avatars.discourse-cdn.com/v4/letter/a/fbc32d/32.png) [@anil\_varghese](https://discuss.elastic.co/u/anil_varghese)\ **Post date:** [May 24, 2016, 10:41pm UTC](https://discuss.elastic.co/t/grok-skipping-line/50605/5 "2016-05-24T22:41:36Z")
Cool. Now i can drop the lines i wanted. Now these 3 lines are parsed as 3 different events. Can i use grok just below that if i need to extract the Start time, End time and Job name? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 25, 2016, 5:27am UTC](https://discuss.elastic.co/t/grok-skipping-line/50605/6 "2016-05-25T05:27:11Z")
Sure. If you want start and end time (etc) in a single event the aggregate filter should be useful. ---
**Author:** ![anil\_varghese](https://avatars.discourse-cdn.com/v4/letter/a/fbc32d/32.png) [@anil\_varghese](https://discuss.elastic.co/u/anil_varghese)\ **Post date:** [May 25, 2016, 6:58pm UTC](https://discuss.elastic.co/t/grok-skipping-line/50605/7 "2016-05-25T18:58:18Z")
Thank you Magnus. But Aggregate is giving me error.. ![](https://us1.discourse-cdn.com/elastic/original/2X/6/655d4811104ffc3680bf6c9cf7cd699d396e8afb.PNG) ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 25, 2016, 7:07pm UTC](https://discuss.elastic.co/t/grok-skipping-line/50605/8 "2016-05-25T19:07:47Z")
The very first paragraph of the [aggregate filter documentation](https://www.elastic.co/guide/en/logstash/current/plugins-filters-aggregate.html) tells you how to install the plugin. ---
**Author:** ![anil\_varghese](https://avatars.discourse-cdn.com/v4/letter/a/fbc32d/32.png) [@anil\_varghese](https://discuss.elastic.co/u/anil_varghese)\ **Post date:** [May 27, 2016, 7:42pm UTC](https://discuss.elastic.co/t/grok-skipping-line/50605/10 "2016-05-27T19:42:30Z")
Thank You Magnus ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:55am UTC](https://discuss.elastic.co/t/grok-skipping-line/50605/11 "2017-07-06T04:55:50Z")