# Handle multiple log levels within an event using grok

**URL:** <https://discuss.elastic.co/t/handle-multiple-log-levels-within-an-event-using-grok/49804>\
**Category:** Logstash\
**Created:** [May 11, 2016, 4:25pm UTC](https://discuss.elastic.co/t/handle-multiple-log-levels-within-an-event-using-grok/49804 "2016-05-11T16:25:48Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![vikas\_J](https://avatars.discourse-cdn.com/v4/letter/v/7ba0ec/32.png) [@vikas\_J](https://discuss.elastic.co/u/vikas_J)\
**Post date:** [May 11, 2016, 4:25pm UTC](https://discuss.elastic.co/t/handle-multiple-log-levels-within-an-event-using-grok/49804/1 "2016-05-11T16:25:48Z")

</div>

I have a apache tomcat log of the following format:

Mar 15, 2014 8:18:33 AM org.apache.catalina.startup.Catalina load  
INFO: Initialization processed in 576 ms  
ERROR: org.apache.thrift.server.TThreadPoolServer - Thrift error occurred during processing of message.  
org.apache.thrift.protocol.TProtocolException: Missing version in readMessageBegin, old client?  
at org.apache.thrift.protocol.TBinaryProtocol.readMessageBegin(TBinaryProtocol.java:200)  
Mar 15, 2014 8:18:33 AM org.apache.catalina.startup.Catalina load  
INFO: Initialization processed in 576 ms  
ERROR: org.apache.thrift.server.TThreadPoolServer - Thrift error occurred during processing of message.  
org.apache.thrift.protocol.TProtocolException: Missing version in readMessageBegin, old client?  
at org.apache.thrift.protocol.TBinaryProtocol.readMessageBegin(TBinaryProtocol.java:200)

Now using multiline, i am able to extract two events from the above logs. However since there are multiple log level messages(INFO and ERROR) in a single event, i am unable to tag fields to to log messages.

Current grok filter cons looks like :  
filter {  
multiline {  
patterns\_dir =\> "/etc/logstash/patterns"  
#pattern =\> "[%{TIMESTAMP\_ISO8601}"  
pattern =\> "^%{TIMESTAMP\_CUSTOM}"  
negate =\> "true"  
what =\> "previous"  
}  
if [type] == "tomcat-log" and "INFO" in [message] {  
mutate {  
add\_tag =\> ["INFO\_TAG"]  
}  
grok {  
patterns\_dir =\> "/etc/logstash/patterns"  
pattern =\> "%{TIMESTAMP\_CUSTOM:date}"  
}  
grok {  
patterns\_dir =\> "/etc/logstash/patterns"  
break\_on\_match =\> false  
match =\> { "message" =\> "%{CUSTOM\_WARNINGLEVEL:warningLevel} %{LINE:level\_info}( %{CUSTOM\_TRACE\_ERROR:error} )?(%{CUSTOM\_TRACE\_EXCEPTION:exception})?(%{CUSTOM\_TRACE\_OTHERS:exception\_info})?(%{CUSTOM\_TRACE\_CAUSED\_BY:caused\_by})?(%{CUSTOM\_TRACE\_OTHERS:cause\_info})?(%{GREEDYDATA:messageText})?" }  
}  
}  
}

The current output looks like :  
{  
"warningLevel": [  
[  
"INFO:"  
]  
],  
"level\_info": [  
[  
"Initialization processed in 576 ms\nERROR: org.apache.thrift.server.TThreadPoolServer - Thrift error occurred during processing of message.\norg.apache.thrift.protocol.TProtocolException: Missing version in readMessageBegin, old client?\nat org.apache.thrift.protocol.TBinaryProtocol.readMessageBegin(TBinaryProtocol.java:200)"  
]  
],  
"error": [  
[  
null  
]  
],  
"exception": [  
[  
null  
]  
],  
"exception\_info": [  
[  
null  
]  
],  
"caused\_by": [  
[  
null  
]  
],  
"cause\_info": [  
[  
null  
]  
],  
"messageText": [  
[  
""  
]  
]  
}

Is there a way i can extract and tag ERROR: log message in the example above?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:58am UTC](https://discuss.elastic.co/t/handle-multiple-log-levels-within-an-event-using-grok/49804/2 "2017-07-06T04:58:09Z")

</div>

Closed on July 6, 2017, 4:58am UTC