# How to handle a complex event with newlines

**URL:** <https://discuss.elastic.co/t/how-to-handle-a-complex-event-with-newlines/119054>\
**Category:** Logstash\
**Created:** [February 8, 2018, 1:39pm UTC](https://discuss.elastic.co/t/how-to-handle-a-complex-event-with-newlines/119054 "2018-02-08T13:39:48Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ssasporta](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ssasporta/32/13695_2.png) [@ssasporta](https://discuss.elastic.co/u/ssasporta)\
**Post date:** [February 8, 2018, 1:39pm UTC](https://discuss.elastic.co/t/how-to-handle-a-complex-event-with-newlines/119054/1 "2018-02-08T13:39:48Z")

</div>

Hi,

My event looks like that:

```
####<Feb 5, 2018 2:57:30 PM CST6CDT> <Info> <APM> <host101> ***Starting Rule Debug Messages February 5, 2018 2:57:30 PM CST6CDT***

[1] ***Rule Name [Set expiration date when eligibility duration is not zero]***
[1.1] Activated On [Component][Sponsored Pass] In Context of [Component] .
[1.2] The rule evaluateResult is [false] .
[1.3] Rule Ended [Successfully] .
      Rule executed in Activity [HandleWiFiProduct] .
[1.4] Rule was activated on ApTechImpl[40163342628__0] Item .

[2] ***Rule Name [Set expiration date when duration is zero]***
[2.1] Activated On [Component][Sponsored Pass] In Context of [Component] .
[2.2] The rule evaluateResult is [false] .
[2.3] Rule Ended [Successfully] .
      Rule executed in Activity [HandleWiFiProduct] .
[2.4] Rule was activated on ApTechImpl[40162344628__0] Item .

```

If the string " **Starting Rule Debug Messages**" exists in the first part, means I will next have list of the rules. **There are new lines** between every part of the event.

The first part can be handle by a grok.  
If the message includes **Starting Rule Debug Messages** , I want to create field Rule1 that will contain the Rule 1 lines, Rule2 will contain the next rule lines etc...

**There are newlines between every part.**

Can I have your advice how to handle it?

I thought to use ruby for it.

Thanks  
Sharon.

---

<div class="post-metadata">

**Author:** ![ssasporta](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ssasporta/32/13695_2.png) [@ssasporta](https://discuss.elastic.co/u/ssasporta)\
**Post date:** [February 8, 2018, 1:52pm UTC](https://discuss.elastic.co/t/how-to-handle-a-complex-event-with-newlines/119054/2 "2018-02-08T13:52:50Z")

</div>

Ok, I am doing it with Ruby as I thought.

It is working. Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 8, 2018, 1:52pm UTC](https://discuss.elastic.co/t/how-to-handle-a-complex-event-with-newlines/119054/3 "2018-03-08T13:52:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.