# How to use multiline pattern matching grok filter?

**URL:** <https://discuss.elastic.co/t/how-to-use-multiline-pattern-matching-grok-filter/129632>\
**Category:** Logstash\
**Created:** [April 26, 2018, 10:01am UTC](https://discuss.elastic.co/t/how-to-use-multiline-pattern-matching-grok-filter/129632 "2018-04-26T10:01:02Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![RameshNagargoje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rameshnagargoje/32/30212_2.png) [@RameshNagargoje](https://discuss.elastic.co/u/RameshNagargoje)\
**Post date:** [April 26, 2018, 10:01am UTC](https://discuss.elastic.co/t/how-to-use-multiline-pattern-matching-grok-filter/129632/1 "2018-04-26T10:01:02Z")

</div>

My use case is to find the line which comes before some pattern line and if that line is found in  
then dump in ES.

Here is a small example.  
In this, if I am finding "dhd\_bus\_rxctl: rxcnt\_timeout" line before the line "dhd\_check\_hang: Event HANG send up due to". For this how we can use grok filter.

15119.753889] dhd\_bus\_rxctl: rxcnt\_timeout=5, rxlen=0  
15119.753889] [] (kthread+0xe0/0xe4) from [] (ret\_from\_fork+0x14/0x20)  
15119.753889] dhd\_bus\_rxctl: rxcnt\_timeout=5, rxlen=0  
15119.753889] dhd\_bus\_rxctl: rxcnt\_timeout=5, rxlen=0  
15119.753889] dhd\_bus\_rxctl: rxcnt\_timeout=5, rxlen=0  
15119.753889] dhd\_bus\_rxctl: rxcnt\_timeout=5, rxlen=0  
[15119.753902] dhd\_check\_hang: Event HANG send up due to re=5 te=0 e=-110 s=2  
[15119.753917] dhd\_check\_hang: Event HANG send up due to re=5 te=0 e=-110 s=2  
[15119.753937] dhd\_prot\_ioctl : bus is down. we have nothing to do  
[15119.791431] [] (schedule\_timeout+0x158/0x25c) from [] (0xea1e0000)  
[15119.799331] kworker/3:2 R running 0 29597 2 0x00000000  
[15119.805699] [] (\_\_schedule+0x3d0/0x8a4) from [] (worker\_thread+0x1fc/0x3dc)  
[15119.814384] [] (worker\_thread+0x1fc/0x3dc) from [] (kthread+0xe0/0xe4)  
[15119.822637] [] (kthread+0xe0/0xe4) from [] (ret\_from\_fork+0x14/0x20)  
[15119.830710] kworker/u8:1 S c0ab2fd4 0 29738 2 0x00000000  
[15119.837078] [] (\_\_schedule+0x3d0/0x8a4) from [] (worker\_thread+0x1fc/0x3dc)  
[15119.845763] [] (worker\_thread+0x1fc/0x3dc) from [] (kthread+0xe0/0xe4)  
[15119.854015] [] (kthread+0xe0/0xe4) from [] (ret\_from\_fork+0x14/0x20)  
[15119.862088] kworker/u8:4 S c0ab2fd4 0 29739 2 0x00000000  
[15119.868455] [] (\_\_schedule+0x3d0/0x8a4) from [] (worker\_thread+0x1fc/0x3dc)  
[15119.877140] [] (worker\_thread+0x1fc/0x3dc) from [] (kthread+0xe0/0xe4)  
[15119.885391] [] (kthread+0xe0/0xe4) from [] (ret\_from\_fork+0x14/0x20)  
[15119.893468] Sched Debug Version: v0.10, 3.10.96+ #1  
[15119.898337] ktime

---

<div class="post-metadata">

**Author:** ![RameshNagargoje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rameshnagargoje/32/30212_2.png) [@RameshNagargoje](https://discuss.elastic.co/u/RameshNagargoje)\
**Post date:** [April 26, 2018, 11:07am UTC](https://discuss.elastic.co/t/how-to-use-multiline-pattern-matching-grok-filter/129632/2 "2018-04-26T11:07:51Z")

</div>

@MariumHassan

---

<div class="post-metadata">

**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\
**Post date:** [April 26, 2018, 12:01pm UTC](https://discuss.elastic.co/t/how-to-use-multiline-pattern-matching-grok-filter/129632/3 "2018-04-26T12:01:03Z")

</div>

Does this help you?

`(?<the_line>.*)\n.*dhd_check_hang: Event HANG`

---

<div class="post-metadata">

**Author:** ![RameshNagargoje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rameshnagargoje/32/30212_2.png) [@RameshNagargoje](https://discuss.elastic.co/u/RameshNagargoje)\
**Post date:** [April 26, 2018, 2:01pm UTC](https://discuss.elastic.co/t/how-to-use-multiline-pattern-matching-grok-filter/129632/4 "2018-04-26T14:01:19Z")

</div>

@Jenni, Yeah its working but it is adding one extra tag i.e. "rxcnt\_timeout" in output json.  
Shown as follow.

" rxcnt\_timeout": "rxctl: rxcnt\_timeout=5, rxlen=0\n 15119.753889] [] (kthread+0xe0/0xe4) from [] (ret\_from\_fork+0x14/0x20)\n 15119.753889] dhd\_bus\_rxctl: rxcnt\_timeout=5, rxlen=0\n 15119.753889] dhd\_bus\_rxctl: rxcnt\_timeout=5, rxlen=0\n 15119.753889] dhd\_bus\_rxctl: rxcnt\_timeout=5, rxlen=0\n 15119.753889] dhd\_bus\_rxctl: rxcnt\_timeout=5, rxlen=0\n [15119.753902] dhd\_check\_hang: Event HANG send up due to re=5 te=0 e=-110 s=2",

---

<div class="post-metadata">

**Author:** ![RameshNagargoje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rameshnagargoje/32/30212_2.png) [@RameshNagargoje](https://discuss.elastic.co/u/RameshNagargoje)\
**Post date:** [April 27, 2018, 7:25am UTC](https://discuss.elastic.co/t/how-to-use-multiline-pattern-matching-grok-filter/129632/5 "2018-04-27T07:25:03Z")

</div>

Slightly change in use case, if line "dhd\_check\_hang: Event HANG send up due to" is matched in logs and line should not "dhd\_bus\_rxctl: rxcnt\_timeout" matched in logs then only dump in ES

---

<div class="post-metadata">

**Author:** ![RameshNagargoje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rameshnagargoje/32/30212_2.png) [@RameshNagargoje](https://discuss.elastic.co/u/RameshNagargoje)\
**Post date:** [May 1, 2018, 9:45am UTC](https://discuss.elastic.co/t/how-to-use-multiline-pattern-matching-grok-filter/129632/6 "2018-05-01T09:45:53Z")

</div>

> [@How to use multiline pattern matching grok filter?](https://discuss.elastic.co/t/how-to-use-multiline-pattern-matching-grok-filter/129632/3):
>
> Does this help you? (?\<the\_line\>.\*)\n.\*dhd\_check\_hang: Event HANG

it matches all lines above "dhd\_check\_hang: Event HANG"

need to match "dhd\_bus\_rxctl: rxcnt\_timeout" before/after "dhd\_check\_hang: Event HANG"

I am editing input as

[1202095.534161] init: smbd main process (15913) killed by TERM signal  
[1211904.223712] init: smbd main process (22226) killed by TERM signal  
[1220472.750723] systemd-hostnamed[14939]: Warning: nss-myhostname is not installed. Changing the local hostname might make it unresolveable. Please install nss-myhostname!  
[1222858.122914] init: smbd main process (3976) killed by TERM signal  
15119.753889] dhd\_bus\_rxctl: rxcnt\_timeout=5, rxlen=0  
15119.753889] (kthread+0xe0/0xe4) from (ret\_from\_fork+0x14/0x20)  
15119.753889] dhd\_bus\_rxctl: rxcnt\_timeout=5, rxlen=0  
15119.753889] dhd\_bus\_rxctl: rxcnt\_timeout=5, rxlen=0  
15119.753889] dhd\_bus\_rxctl: rxcnt\_timeout=5, rxlen=0  
15119.753889] dhd\_bus\_rxctl: rxcnt\_timeout=5, rxlen=0  
[15119.753902] dhd\_check\_hang: Event HANG send up due to re=5 te=0 e=-110 s=2  
[15119.753917] dhd\_check\_hang: Event HANG send up due to re=5 te=0 e=-110 s=2  
[15119.753937] dhd\_prot\_ioctl : bus is down. we have nothing to do  
[15119.791431] (schedule\_timeout+0x158/0x25c) from (0xea1e0000)  
[15119.799331] kworker/3:2 R running 0 29597 2 0x00000000  
[15119.805699] (\_\_schedule+0x3d0/0x8a4) from (worker\_thread+0x1fc/0x3dc)  
[15119.814384] (worker\_thread+0x1fc/0x3dc) from (kthread+0xe0/0xe4)  
[15119.822637] (kthread+0xe0/0xe4) from (ret\_from\_fork+0x14/0x20)  
[15119.830710] kworker/u8:1 S c0ab2fd4 0 29738 2 0x00000000  
[15119.837078] (\_\_schedule+0x3d0/0x8a4) from (worker\_thread+0x1fc/0x3dc)  
[15119.845763] (worker\_thread+0x1fc/0x3dc) from (kthread+0xe0/0xe4)  
[15119.854015] (kthread+0xe0/0xe4) from (ret\_from\_fork+0x14/0x20)  
[15119.862088] kworker/u8:4 S c0ab2fd4 0 29739 2 0x00000000  
[15119.868455] (\_\_schedule+0x3d0/0x8a4) from (worker\_thread+0x1fc/0x3dc)  
[15119.877140] (worker\_thread+0x1fc/0x3dc) from (kthread+0xe0/0xe4)  
[15119.885391] (kthread+0xe0/0xe4) from (ret\_from\_fork+0x14/0x20)  
[15119.893468] Sched Debug Version: v0.10, 3.10.96+ #1  
[15119.898337] ktime

output should be matched lines.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 29, 2018, 9:46am UTC](https://discuss.elastic.co/t/how-to-use-multiline-pattern-matching-grok-filter/129632/7 "2018-05-29T09:46:02Z")

</div>

Closed on May 29, 2018, 9:46am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.