# How to filter windows events logs events with newlines

**URL:** <https://discuss.elastic.co/t/how-to-filter-windows-events-logs-events-with-newlines/44245>\
**Category:** Logstash\
**Created:** [March 13, 2016, 3:30am UTC](https://discuss.elastic.co/t/how-to-filter-windows-events-logs-events-with-newlines/44245 "2016-03-13T03:30:40Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![s802645](https://avatars.discourse-cdn.com/v4/letter/s/3d9bf3/32.png) [@s802645](https://discuss.elastic.co/u/s802645)\
**Post date:** [March 13, 2016, 3:30am UTC](https://discuss.elastic.co/t/how-to-filter-windows-events-logs-events-with-newlines/44245/1 "2016-03-13T03:30:40Z")

</div>

Hi,

I received windows events from another source in this format:

```
EventCode=1234
EvenType= blah blah
User=me
Message= 
  key1:value1
  arbitrarty
  ....

```

Each event entry that comes into log stash has a newline. I just want to concatenate together to become like this:

EventCode=1234, Eventype=......

in one line.

How can I craft my filter to do this? Is it through a multiline input filter?  
thanks

---

<div class="post-metadata">

**Author:** ![arizonawayfarer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arizonawayfarer/32/44846_2.png) [@arizonawayfarer](https://discuss.elastic.co/u/arizonawayfarer)\
**Post date:** [March 14, 2016, 11:20pm UTC](https://discuss.elastic.co/t/how-to-filter-windows-events-logs-events-with-newlines/44245/2 "2016-03-14T23:20:38Z")

</div>

Here's one I put together for event ID 4624. I have no idea if this is optimal, there really doesn't seem to be much in the way of grok guidelines ☹

```
  grok {
    break_on_match => true
    match => {
      'message' => '%{DATA:event_message}\n\nSubject:\n\tSecurity ID:\t\t%{DATA:security_id}\n\tAccount Name:\t\t%{DATA:subject_accountname}\n\tAccount Domain:\t\t%{DATA:subject_accountdomain}\n\tLogon ID:\t\t%{DATA:subject_logonid}\n\nLogon Type:\t\t\t%{INT:logon_type}\n\n(Impersonation Level:\t\t%{WORD:impersonation_level}\n\n)?New Logon:\n\tSecurity ID:\t\t%{DATA:logon_securityid}\n\tAccount Name:\t\t%{DATA:logon_accountname}\n\tAccount Domain:\t\t%{DATA:logon_accountdomain}\n\tLogon ID:\t\t%{DATA:logon_logonid}\n\tLogon GUID:\t\t%{DATA:logon_logonguid}\n\nProcess Information:\n\tProcess ID:\t\t%{DATA:process_processid}\n\tProcess Name:\t\t%{DATA:process_processname}\n\nNetwork Information:\n\tWorkstation Name:\t\t*%{DATA:networkinfo_workstationname}\n\tSource Network Address:\t%{DATA:network_address}\n\tSource Port:\t\t%{DATA:network_sourceport}\n\nDetailed Authentication Information:\n\tLogon Process:\t\t%{DATA:auth_logonprocess}\n\tAuthentication Package:\t%{DATA:auth_authpackage}\n\tTransited Services:\t%{DATA:auth_transitedservices}\n\tPackage Name \(NTLM only\):\t%{DATA:auth_packagename}\n\tKey Length:\t\t%{INT:auth_keylength}'
    }
  }
```

---

<div class="post-metadata">

**Author:** ![s802645](https://avatars.discourse-cdn.com/v4/letter/s/3d9bf3/32.png) [@s802645](https://discuss.elastic.co/u/s802645)\
**Post date:** [March 19, 2016, 5:02am UTC](https://discuss.elastic.co/t/how-to-filter-windows-events-logs-events-with-newlines/44245/3 "2016-03-19T05:02:39Z")

</div>

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:06am UTC](https://discuss.elastic.co/t/how-to-filter-windows-events-logs-events-with-newlines/44245/4 "2017-07-06T05:06:20Z")

</div>