# How do I get first line from multiline message by using logstash 1.5? **URL:** https://discuss.elastic.co/t/how-do-i-get-first-line-from-multiline-message-by-using-logstash-1-5/1817 **Category:** Logstash **Created:** [June 3, 2015, 11:18am UTC](https://discuss.elastic.co/t/how-do-i-get-first-line-from-multiline-message-by-using-logstash-1-5/1817 "2015-06-03T11:18:52Z") **Posts on this page:** 8 **Page:** 1
### Author: ![abcfy2](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abcfy2/32/453_2.png) [@abcfy2](https://discuss.elastic.co/u/abcfy2) #### Post date: [June 3, 2015, 11:18am UTC](https://discuss.elastic.co/t/how-do-i-get-first-line-from-multiline-message-by-using-logstash-1-5/1817/1 "2015-06-03T11:18:52Z")
Here is a sample: ```auto { "@timestamp" => "2015-06-03T11:12:43.776Z", "message" => "2015-06-03 16:40:30,356 [DefaultQuartzScheduler_Worker-9] ERROR StackTrace - Full Stack Trace:\norg.springframework.transaction.UnexpectedRollbackException: Transaction rolled back because it has been marked as rollback-only\nhawkeyes.logat hawkeyes.quartz.JobTemplate.execute(JobTemplate.groovy:10)\nhawkeyes.logat org.quartz.core.JobRunShell.run(JobRunShell.java:202)\nhawkeyes.logat org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:525)", "@version" => "1", "tags" => [ [0] "multiline", [1] "hawkeyes_log", [2] "log4j" ], "type" => "hawkeyes", "host" => "hawkeyesTest", "path" => "/mnt/log/hawkeyeslogs/hawkeyes.log", "date" => "2015-06-03 16:40:30,356", "thread_name" => "DefaultQuartzScheduler_Worker-9", "log_level" => "ERROR", "content" => "StackTrace - Full Stack Trace:\norg.springframework.transaction.UnexpectedRollbackException: Transaction rolled back because it has been marked as rollback-only\nhawkeyes.logat hawkeyes.quartz.JobTemplate.execute(JobTemplate.groovy:10)\nhawkeyes.logat org.quartz.core.JobRunShell.run(JobRunShell.java:202)\nhawkeyes.logat org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:525)" ``` Here is my grok config: ```auto grok { match => { "message" => "%{TIMESTAMP_ISO8601:date} \[(?.+?)\] (?\w+)\s*(?.*)" } } ``` In logstash 1.4, the `content` variable will only get the first line content("StackTrace - Full Stack Trace:"). But in logstash 1.5, this variable will hold the whole multiline message. How do I make this variable only the first line? ---
### Author: ![abcfy2](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abcfy2/32/453_2.png) [@abcfy2](https://discuss.elastic.co/u/abcfy2) #### Post date: [June 4, 2015, 2:18am UTC](https://discuss.elastic.co/t/how-do-i-get-first-line-from-multiline-message-by-using-logstash-1-5/1817/2 "2015-06-04T02:18:13Z")
I solved this issue by myself. I find the filter [mutate](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html) can solve my issue. Here is my config: ```auto filter{ mutate { gsub => [ "content", "\n.*", "" ] } } ``` ---
### Author: ![abcfy2](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abcfy2/32/453_2.png) [@abcfy2](https://discuss.elastic.co/u/abcfy2) #### Post date: [June 5, 2015, 1:19am UTC](https://discuss.elastic.co/t/how-do-i-get-first-line-from-multiline-message-by-using-logstash-1-5/1817/4 "2015-06-05T01:19:09Z")
But the grok in logstash 1.4.2 could not match the multiline. I used logstash since 1.4.2. So I find that the grok in 1.5.0 could match multiline. ---
### Author: ![rafaltrojniak](https://avatars.discourse-cdn.com/v4/letter/r/ecc23a/32.png) [@rafaltrojniak](https://discuss.elastic.co/u/rafaltrojniak) #### Post date: [June 5, 2015, 6:48am UTC](https://discuss.elastic.co/t/how-do-i-get-first-line-from-multiline-message-by-using-logstash-1-5/1817/5 "2015-06-05T06:48:09Z")
@abcfy2 AFAIR grok in logstash 1.4.2 supports multiline matches. Do you have manual page where it says otherwise ? Have you tried to add '(?m)' at beginning of your match ? Just like suggested here in first response. > ---
### Author: ![abcfy2](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abcfy2/32/453_2.png) [@abcfy2](https://discuss.elastic.co/u/abcfy2) #### Post date: [June 5, 2015, 9:44am UTC](https://discuss.elastic.co/t/how-do-i-get-first-line-from-multiline-message-by-using-logstash-1-5/1817/6 "2015-06-05T09:44:25Z")
Oh sorry. I don't know about `?m`. This grok regex in 1.4.2 could not match the multiline, so I thought grok could not match multiline. Got the new tech. ---
### Author: ![ourlord](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ourlord/32/485_2.png) [@ourlord](https://discuss.elastic.co/u/ourlord) #### Post date: [June 5, 2015, 5:28pm UTC](https://discuss.elastic.co/t/how-do-i-get-first-line-from-multiline-message-by-using-logstash-1-5/1817/7 "2015-06-05T17:28:33Z")
I'm using Grok in 1.4.2 with multiline codec, works fine. You can test your Grok pattern with multiline context in this [online testing tool](http://grokconstructor.appspot.com/do/match#result). ---
### Author: ![coolzong](https://avatars.discourse-cdn.com/v4/letter/c/ed8c4c/32.png) [@coolzong](https://discuss.elastic.co/u/coolzong) #### Post date: [March 17, 2016, 8:45am UTC](https://discuss.elastic.co/t/how-do-i-get-first-line-from-multiline-message-by-using-logstash-1-5/1817/8 "2016-03-17T08:45:33Z")
If use Grok 1.5.x, and want to let it work like Grok 1.4.x, you can add (?-m) before your pattern, disable the default multiline function of 1.5. ---
### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system) #### Post date: [July 6, 2017, 5:06am UTC](https://discuss.elastic.co/t/how-do-i-get-first-line-from-multiline-message-by-using-logstash-1-5/1817/9 "2017-07-06T05:06:40Z")