# How to extract data from multiline(codec)

**URL:** <https://discuss.elastic.co/t/how-to-extract-data-from-multiline-codec/287575>\
**Category:** Logstash\
**Created:** [October 25, 2021, 12:22pm UTC](https://discuss.elastic.co/t/how-to-extract-data-from-multiline-codec/287575 "2021-10-25T12:22:15Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![INS](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ins/32/92827_2.png) [@INS](https://discuss.elastic.co/u/INS)\
**Post date:** [October 25, 2021, 12:22pm UTC](https://discuss.elastic.co/t/how-to-extract-data-from-multiline-codec/287575/1 "2021-10-25T12:22:15Z")

</div>

Hi  
Does anyone know how to extract data from under the codec multiline.  
After parse xml data I need to avoid the header (prefix of name measData ) for whole of ingested rows...  
it makes also some keyword field and multi field. How to prepare such data for pure ingest in elastic?

```auto
{
  "_index": "logstash-s",
  "_type": "_doc",
  "_id": "LgsyuHwBykpzZ66Oiyu9",
  "_version": 1,
  "_score": null,
  "fields": {
    "measData.succImmediateAssignProcs": [
      "789"
    ],
    "measData.measInfoId": [
      "Node1"
    ],
    "measData.userLabel.keyword": [
      "RNC Telecomville"
    ],
    "measData.userLabel": [
      "RNC Telecomville"
    ],
    "measData.measInfoId.keyword": [
      "Node1"

```

---

<div class="post-metadata">

**Author:** ![INS](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ins/32/92827_2.png) [@INS](https://discuss.elastic.co/u/INS)\
**Post date:** [October 25, 2021, 3:35pm UTC](https://discuss.elastic.co/t/how-to-extract-data-from-multiline-codec/287575/2 "2021-10-25T15:35:07Z")

</div>

or in the other word how to move dynamically attributes EsmExtDbModifyTimeoutResponses, measInfoId etc to the root

 ![meas](https://us1.discourse-cdn.com/elastic/original/3X/c/b/cb938df2054cda8ed83afc0ed7df2b3e49dea859.png)

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 25, 2021, 7:26pm UTC](https://discuss.elastic.co/t/how-to-extract-data-from-multiline-codec/287575/3 "2021-10-25T19:26:39Z")

</div>

If measData is an object, then see [here](https://discuss.elastic.co/t/how-to-dynamically-move-nested-key-value-to-root-level/180006/2). If you want to remove a prefix from the key name you could try

```
ruby {
    code => '
        event.to_hash.each { |k, v|
            if k =~ /^measData\./
                newK = k.sub(/^measData\./, "")
                event.set(newK, event.remove(k))
            end
        }
    '
}
```

---

<div class="post-metadata">

**Author:** ![INS](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ins/32/92827_2.png) [@INS](https://discuss.elastic.co/u/INS)\
**Post date:** [October 25, 2021, 7:34pm UTC](https://discuss.elastic.co/t/how-to-extract-data-from-multiline-codec/287575/4 "2021-10-25T19:34:26Z")

</div>

oh, many thank @Badger will try and get back with result 😉

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 22, 2021, 7:34pm UTC](https://discuss.elastic.co/t/how-to-extract-data-from-multiline-codec/287575/5 "2021-11-22T19:34:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.