\w+)\b.*;)?(?:\n)?(?:# Time:.*\n)?`
after I have tried many times, I found out that it would drop not only the first line start with "# Time",and also the whole message that the grok pattern matched next!!!
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [December 21, 2016, 6:35am UTC](https://discuss.elastic.co/t/how-to-drop-a-message/69548/4 "2016-12-21T06:35:25Z")
Well, yes. It seems you're using a multiline codec to join the physical lines of a logical event. If you do that you can't use the drop filter.
---
### Author:  [@houfan](https://discuss.elastic.co/u/houfan)
#### Post date: [December 21, 2016, 6:47am UTC](https://discuss.elastic.co/t/how-to-drop-a-message/69548/5 "2016-12-21T06:47:18Z")
eeeeee.......really thans for your reply
cos this is mysql-slow.log.so I have to use the multiline codec .
now ,how can I drop this line: 😠....."# Time: 161214 1:31:33"
I tried this:
> grok {
> match =\> { "message" =\> "^# Time:\s+\d{6}\s+\d{1,2}:\d{2}:\d{2}\n" }
> add\_tag =\> ["time"]
> tag\_on\_failure =\>
> }
> if "time" in [tags] {
> drop {}
> }
but it didn't work. and I tried another way like this:
> if "\_grokparsefailure" in [tags] {
> drop {}
> }
this did work,but I think it is not a proper way to drop this message.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [December 21, 2016, 6:48am UTC](https://discuss.elastic.co/t/how-to-drop-a-message/69548/6 "2016-12-21T06:48:34Z")
Why do you need to drop that line? Just ignore the timestamp in your grok filter if you don't care about it.
---
### Author:  [@houfan](https://discuss.elastic.co/u/houfan)
#### Post date: [December 21, 2016, 7:05am UTC](https://discuss.elastic.co/t/how-to-drop-a-message/69548/7 "2016-12-21T07:05:40Z")
cos mysql-slow.log has two different heads. one is :
> ```
> # Time: 161214 10:21:28
> # User@Host: alltechremotecon[alltechremotecon] @ [218.17.162.125] Id: 4876018124
> # Schema: gcenter3x Last_errno: 0 Killed: 0
> # Query_time: 194.159645 Lock_time: 0.000040 Rows_sent: 50810 Rows_examined: 50810 Rows_affected: 0
> # Bytes_sent: 8707551
> SET timestamp=1481682088;
> SELECT * FROM `december_data_upload`;
>
> ```
another one is this:
> ```
> # administrator command: Prepare;
> # User@Host: gcenter[gcenter] @ [192.168.168.100] Id: 4882345700
> # Schema: gcenter Last_errno: 0 Killed: 0
> # Query_time: 5.883876 Lock_time: 0.000000 Rows_sent: 0 Rows_examined: 0 Rows_affected: 0
> # Bytes_sent: 435
> use gcenter;
> SET timestamp=1481691552;
>
> ```
and I think I can only set the pattern in multiline codec like this:
> pattern: ^# User@Host
I add this part at the end of my grok pattern:
> (?:# Time:.\*\n)?(?:#\s+%{WORD}\s+%{WORD}:\s+\w+;\n)?
it will ignore these two messages "# Time: 161214 10:21:28 " "# administrator command: Prepare;" only if they are not at the first line.
now I am considering the situation when the log rotate,and one of these two messages comes to the first line.....how to solve this ðŸ˜
and really thank you
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [December 21, 2016, 7:29am UTC](https://discuss.elastic.co/t/how-to-drop-a-message/69548/8 "2016-12-21T07:29:07Z")
I still don't understand. If you look for the User@Host line in the multiline pattern and don't care about the Time value, why does it matter where the Time value ends up? Just adjust your grok expression to handle all cases. You can also use a mutate filter's gsub option to remove the Time value regardless of where in the string it occurs.
---
### Author:  [@houfan](https://discuss.elastic.co/u/houfan)
#### Post date: [December 21, 2016, 8:31am UTC](https://discuss.elastic.co/t/how-to-drop-a-message/69548/9 "2016-12-21T08:31:34Z")
...........I am just a rookie here. I still don't know how to modify the logstash.conf . Could you give me a template or example...ðŸ˜
really really thanks 😀
I bought a book about ELK...wrote by a chinese author.and it didn't help me a lot. so far ,I could only get help from the internet ,especially from this forum,from you...it's a sad story ðŸ˜
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 18, 2017, 8:31am UTC](https://discuss.elastic.co/t/how-to-drop-a-message/69548/10 "2017-01-18T08:31:45Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.