# How do I get the first 2 lines of a multiline log using logstash 2.4.0?

**URL:** https://discuss.elastic.co/t/how-do-i-get-the-first-2-lines-of-a-multiline-log-using-logstash-2-4-0/106260
**Category:** Logstash
**Created:** [November 2, 2017, 11:11pm UTC](https://discuss.elastic.co/t/how-do-i-get-the-first-2-lines-of-a-multiline-log-using-logstash-2-4-0/106260 "2017-11-02T23:11:58Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![Jerry\_Hoffmeister](https://avatars.discourse-cdn.com/v4/letter/j/90ced4/32.png) [@Jerry\_Hoffmeister](https://discuss.elastic.co/u/Jerry_Hoffmeister)
#### Post date: [November 2, 2017, 11:11pm UTC](https://discuss.elastic.co/t/how-do-i-get-the-first-2-lines-of-a-multiline-log-using-logstash-2-4-0/106260/1 "2017-11-02T23:11:58Z")

</div>

Hi...

I figured out how to get the first line using this post: [How do I get first line from multiline message by using logstash 1.5?](https://discuss.elastic.co/t/how-do-i-get-first-line-from-multiline-message-by-using-logstash-1-5/1817)

using this config:

```
filter {
  if [type] == "java" {
    grok {
      # Do multiline matching with (?m)
      match => ["message", "(?m)^%{TIMESTAMP_ISO8601:java_timestamp}%{SPACE}%{LOGLEVEL:loglevel}%{SPACE}%{NUMBER:pid}%{SPACE}(\[%{TRANSID:transactionId}\]%{SPACE})?---%{SPACE}%{SYSLOG5424SD:thread}%{SPACE}%{JAVACLASSSHORT:class}%{SPACE}:%{SPACE}%{GREEDYDATA:logmessage}" ]
      patterns_dir => "/etc/logstash/conf.d/patterns"
      add_field => ["received_at", "%{@timestamp}"]
      add_field => ["received_from", "%{host}"]
    }
    mutate {
      add_field => { "message_first_line" => "%{message}" }
    }
    mutate {
      gsub => [
        "message_first_line", "\n.*", ""
      ]
    }
    date {
      match => ["java_timestamp", "ISO8601"]
    }
  }
}

```

The gsub section replaces everything after and including the first \n with "".

Which I thot was quite clever but what I really want is to see the first line of the stack trace as well - log might look like:

```
2017-11-02 20:49:54.859 ERROR 14703 [CoreProcess] --- [pool-7-thread-1] e.u.i.e.b.integration.PollerIntegration : Connection failure for client drs, recovering with blank message.

org.springframework.messaging.MessagingException: Failed to execute on session; nested exception is org.springframework.core.NestedIOException: Failed to list files; nested exception is 2: No such file
	at org.springframework.integration.file.remote.RemoteFileTemplate.execute(RemoteFileTemplate.java:419)
	at org.springframework.integration.file.remote.gateway.AbstractRemoteFileOutboundGateway.doLs(AbstractRemoteFileOutboundGateway.java:500)
	at org.springframework.integration.file.remote.gateway.AbstractRemoteFileOutboundGateway.handleRequestMessage(AbstractRemoteFileOutboundGateway.java:469)
	at org.springframework.integration.handler.AbstractReplyProducingMessageHandler$AdvisedRequestHandler.handleRequestMessage(AbstractReplyProducingMessageHandler.java:144)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:498)

```

What I really want is the first line plus the first line of the stack trace IF it's a multiline log otherwise just the first line.

Can anyone help?

I found this which looked promising: [https://stackoverflow.com/questions/5422949/how-to-find-the-3rd-occurrence-of-a-pattern-on-a-line](https://stackoverflow.com/questions/5422949/how-to-find-the-3rd-occurrence-of-a-pattern-on-a-line)

I tried this config and some similar permutations:

```
mutate {
  add_field => { "message_first_2_lines" => "%{message}" }
}
mutate {
  gsub => [
    "message_first_2_lines", "^((?:.*?\n){2}).*$", "\1"
  ]
}

```

Without good results - the .\*$ didn't seem to match the entire multiline string.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 30, 2017, 11:12pm UTC](https://discuss.elastic.co/t/how-do-i-get-the-first-2-lines-of-a-multiline-log-using-logstash-2-4-0/106260/2 "2017-11-30T23:12:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.