# How to extract first line of a multiline message?

**URL:** <https://discuss.elastic.co/t/how-to-extract-first-line-of-a-multiline-message/124163>\
**Category:** Logstash\
**Created:** [March 15, 2018, 7:09pm UTC](https://discuss.elastic.co/t/how-to-extract-first-line-of-a-multiline-message/124163 "2018-03-15T19:09:42Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![proximator](https://avatars.discourse-cdn.com/v4/letter/p/c68b51/32.png) [@proximator](https://discuss.elastic.co/u/proximator)\
**Post date:** [March 15, 2018, 7:09pm UTC](https://discuss.elastic.co/t/how-to-extract-first-line-of-a-multiline-message/124163/1 "2018-03-15T19:09:42Z")

</div>

I need to add a new field as the first line of a multline message coming from filebeat to logstash?  
Then from this line, a substring of this line as new field which I need to parse it as timestamp?

Thanks for your help.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 18, 2018, 8:12pm UTC](https://discuss.elastic.co/t/how-to-extract-first-line-of-a-multiline-message/124163/2 "2018-03-18T20:12:34Z")

</div>

Don't describe what you want to do, show examples instead.

---

<div class="post-metadata">

**Author:** ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)\
**Post date:** [March 19, 2018, 4:01am UTC](https://discuss.elastic.co/t/how-to-extract-first-line-of-a-multiline-message/124163/3 "2018-03-19T04:01:23Z")

</div>

Gotta agree with Magnusbaeck here, need a little more. Do you have a sample document you can share that you are trying to ingest? If you are just trying to add a new field, you can do that in the filter section with any of the filters, it's a common function to all of them.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 16, 2018, 4:01am UTC](https://discuss.elastic.co/t/how-to-extract-first-line-of-a-multiline-message/124163/4 "2018-04-16T04:01:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.