# GrokDebugger work well but not in logstash

**URL:** <https://discuss.elastic.co/t/grokdebugger-work-well-but-not-in-logstash/59327>\
**Category:** Logstash\
**Created:** [August 30, 2016, 3:01pm UTC](https://discuss.elastic.co/t/grokdebugger-work-well-but-not-in-logstash/59327 "2016-08-30T15:01:59Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![gitbub1992](https://avatars.discourse-cdn.com/v4/letter/g/ecccb3/32.png) [@gitbub1992](https://discuss.elastic.co/u/gitbub1992)\
**Post date:** [August 30, 2016, 3:01pm UTC](https://discuss.elastic.co/t/grokdebugger-work-well-but-not-in-logstash/59327/1 "2016-08-30T15:01:59Z")

</div>

![](https://us1.discourse-cdn.com/elastic/original/2X/e/ea6a08868ee91db58ee9755bca4b8635dc54682d.png)  
Grok pattern test well in GrokDebugger,but got nothing in logstash after process input file with multiline.  
Input looks like this:

```auto
[2016-08-30 15:09:30,906][/data/release/cdn/cgi/apps/cdn/RequestAjax.class.php:176:__destruct][25727][2:1] \n============= response ============\nHTTP: 165 ms, action=get_diagnose_list\nrequest = {\"action\":\"get_diagnose_list\",\"_format\":\"jsonp\",\"g_tk\":\"1232608870\",\"cb\":\"jQuery110205107408485770859_1472540967831\",\"_\":\"1472540967833\"}\nresponse = {\"code\":0,\"data\":{\"total\":1,\"list\":[{\"task_id\":141,\"url\":\"http:\\/\\/addhosttest2.oa.com\",\"report_id\":\"7abfef7c\",\"ip\":\"182.131.19.97\",\"create_time\":\"2016-08-15 14:57:38\",\"status\":3,\"sub_diagnose\":0,\"final_diagnose\":1,\"prov_name\":\"\\u56db\\u5ddd\\u7701\"}]}}\ninfo = {\"appId\":1251007194,\"uin\":909619400,\"costTime\":165}

```

Grok pattern :

```auto
\[%{TIMESTAMP_ISO8601:timestamp}\]\[%{DATA:file_name}\]\[%{DATA:thread_num}\]\[%{DATA:line}\](?<char_1>(\s|\r|\n|.)*HTTP:(\s)*)(?<timecost>\d{1,5})\ ms,\ action=%{DATA:action}\\nrequest\ \ =\ (?<request>.*)\\nresponse\ =\ (?<response>.*)\\ninfo\ =\ (?<info>(.|\n)*)

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:40am UTC](https://discuss.elastic.co/t/grokdebugger-work-well-but-not-in-logstash/59327/2 "2017-07-06T04:40:54Z")

</div>