# Kibana grok debug custom pattern failure

**URL:** https://discuss.elastic.co/t/kibana-grok-debug-custom-pattern-failure/199655
**Category:** Kibana
**Created:** [September 16, 2019, 12:10pm UTC](https://discuss.elastic.co/t/kibana-grok-debug-custom-pattern-failure/199655 "2019-09-16T12:10:46Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![zozo6015](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zozo6015/32/12117_2.png) [@zozo6015](https://discuss.elastic.co/u/zozo6015)
#### Post date: [September 16, 2019, 12:10pm UTC](https://discuss.elastic.co/t/kibana-grok-debug-custom-pattern-failure/199655/1 "2019-09-16T12:10:47Z")

</div>

Hello I have a grok pattern with multiline pattern. On version 6.x everything worked but since I have migrated to 7.3.0 is not working anymore. I have tried to see if it is still matching in kibana but I always get an error messages:

![10](https://us1.discourse-cdn.com/elastic/original/3X/f/4/f4ab2a3c5b1df45005f4a2821eafb5160cf9914b.png)

Any suggestion what can I change to make it work again?

---

<div class="post-metadata">

### Author: ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)
#### Post date: [September 16, 2019, 6:40pm UTC](https://discuss.elastic.co/t/kibana-grok-debug-custom-pattern-failure/199655/2 "2019-09-16T18:40:06Z")

</div>

Hey @zozo6015, when using the Grok Debugger, you specify custom patterns like the following:

```auto
GREEDYMULTILINE (.|\r|\n)*

```

 ![35%20AM](https://us1.discourse-cdn.com/elastic/original/3X/d/5/d53c914e4b25488fd026997ce42ad128b8c680c2.png)

Also, instead of using `\n` in your Sample Data, you'll want to use a newline itself:

```auto
Sep 16, 2019 9:51:52 AM com.candorgrc.core.login.UsersSessionManager logoutSession
INFO: ======== UsersSessionManager.logoutSession: node0n8qucd2hkkosxo25r5ff1e67j263286

```

 ![54%20AM](https://us1.discourse-cdn.com/elastic/original/3X/5/2/52ff2b45f2187d1fcdaa7ba6583b17a7d1beaf7f.png)

---

<div class="post-metadata">

### Author: ![zozo6015](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zozo6015/32/12117_2.png) [@zozo6015](https://discuss.elastic.co/u/zozo6015)
#### Post date: [September 16, 2019, 7:28pm UTC](https://discuss.elastic.co/t/kibana-grok-debug-custom-pattern-failure/199655/3 "2019-09-16T19:28:05Z")

</div>

> [@Brandon\_Kobel](#):
>
> Also, instead of using `\n` in your Sample Data, you'll want to use a newline itself:
> 
> ```auto
> 
> ```

Thank you, now I only need to figure out why the logstash does not want to handle the custom pattern.

---

<div class="post-metadata">

### Author: ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)
#### Post date: [September 16, 2019, 8:08pm UTC](https://discuss.elastic.co/t/kibana-grok-debug-custom-pattern-failure/199655/4 "2019-09-16T20:08:38Z")

</div>

If you post a new question over in the Logstash section, they should be able to help you out.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 14, 2019, 8:09pm UTC](https://discuss.elastic.co/t/kibana-grok-debug-custom-pattern-failure/199655/5 "2019-10-14T20:09:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.