# Handle Multiline logs, where number of lines are not sure?

**URL:** <https://discuss.elastic.co/t/handle-multiline-logs-where-number-of-lines-are-not-sure/280757>\
**Category:** Elasticsearch\
**Created:** [August 9, 2021, 3:47am UTC](https://discuss.elastic.co/t/handle-multiline-logs-where-number-of-lines-are-not-sure/280757 "2021-08-09T03:47:57Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![bpandit](https://avatars.discourse-cdn.com/v4/letter/b/2acd7d/32.png) [@bpandit](https://discuss.elastic.co/u/bpandit)\
**Post date:** [August 9, 2021, 3:47am UTC](https://discuss.elastic.co/t/handle-multiline-logs-where-number-of-lines-are-not-sure/280757/1 "2021-08-09T03:47:57Z")

</div>

I need a way to handle multi line logs, where number of lines are not sure, below is the log data, where start

```auto
[29-Apr-2018 16:46:32] [pool int-mobileapp] pid 30064
script_filename = /var/www/html/int-mobileapp/index.php
[0x00007f91b7c1c840] oci_execute() /var/www/html/int-mobileapp/system/database/drivers/oci8/oci8_driver.php:286
[0x00007f91b7c1c7c0] _execute() /var/www/html/int-mobileapp/system/database/DB_driver.php:791
[0x00007f91b7c1c750] simple_query() /var/www/html/int-mobileapp/system/database/DB_driver.php:654

```

I can handle multilne logs using multiline codec in input however, i have no idea about handeling the unknow number of line that should be groked,I want the output in following pattern,

```auto
"date" => "29-Apr-2018 16:46:32"
"server" => "pool int-mobileapp"
"pid" => "30064"
"script_filename" => "/var/www/html/int-mobileapp/index.php"
"function" => ["oci_execute()", "_execute()", "simple_query()"]
"path" => ["/var/www/html/int-mobileapp/system/database/drivers/oci8/oci8_driver.php" , "/var/www/html/int-mobileapp/system/database/DB_driver.php", "/var/www/html/int-mobileapp/system/database/DB_driver.php"]
"line_number" => ["286", "791", "654"]

```

How can I accomplish this?  
Thanks a lot!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 6, 2021, 3:48am UTC](https://discuss.elastic.co/t/handle-multiline-logs-where-number-of-lines-are-not-sure/280757/2 "2021-09-06T03:48:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.