# Hyphen-minus with a new line

**URL:** <https://discuss.elastic.co/t/hyphen-minus-with-a-new-line/236477>\
**Category:** Logstash\
**Created:** [June 10, 2020, 9:36am UTC](https://discuss.elastic.co/t/hyphen-minus-with-a-new-line/236477 "2020-06-10T09:36:24Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Burga](https://avatars.discourse-cdn.com/v4/letter/b/9d8465/32.png) [@Burga](https://discuss.elastic.co/u/Burga)\
**Post date:** [June 10, 2020, 9:36am UTC](https://discuss.elastic.co/t/hyphen-minus-with-a-new-line/236477/1 "2020-06-10T09:36:24Z")

</div>

Hi , I'm trying to grok log with a multiple lines and Hyphen-minus and got stuck

```auto
2020-06-10 10:06:59,821 WARN [ImageFilterEffect:thread-1] [confluence.image.effects.ImageFilterTask] rotateWhenExifExist Could not retrieve exif info.
 -- url: /confluence/download/attachments/125736733/hardware%20certification.jpg | referer: https://wiki.checkpoint.com/confluence/ | traceId: 031d85ca5d5db288 | userName: roniz

```

here "-- url" is already a new line

my grok filter is

```auto
(?m)%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:level} \[%{DATA:thread}\] \[%{DATA}\] %{SPACE}%{WORD}%{SPACE}%{DATA:Error}\. 

```

please need your assistance .

---

<div class="post-metadata">

**Author:** ![andres-perez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andres-perez/32/136461_2.png) [@andres-perez](https://discuss.elastic.co/u/andres-perez)\
**Post date:** [June 10, 2020, 11:57am UTC](https://discuss.elastic.co/t/hyphen-minus-with-a-new-line/236477/2 "2020-06-10T11:57:02Z")

</div>

Hi!

I don't know about your multiline configuration and intended use case (what to do with the second line with hyphen - minus. " -- url: ..." line.

Anyway, there is a blank space before the ` %{SPACE}%{WORD}%{SPACE}` so your pattern looks for 2 spaces before a word instead of just 1.

You can check it [https://grokconstructor.appspot.com/do/match](https://grokconstructor.appspot.com/do/match) , it's a good idea to start adding elements one by one to your pattern and confirm that they are working as intended.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 8, 2020, 11:57am UTC](https://discuss.elastic.co/t/hyphen-minus-with-a-new-line/236477/3 "2020-07-08T11:57:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.