# Line break in grok pattern

**URL:** <https://discuss.elastic.co/t/line-break-in-grok-pattern/324369>\
**Category:** Logstash\
**Created:** [January 31, 2023, 8:40pm UTC](https://discuss.elastic.co/t/line-break-in-grok-pattern/324369 "2023-01-31T20:40:08Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mariana17](https://avatars.discourse-cdn.com/v4/letter/m/b487fb/32.png) [@mariana17](https://discuss.elastic.co/u/mariana17)\
**Post date:** [January 31, 2023, 8:40pm UTC](https://discuss.elastic.co/t/line-break-in-grok-pattern/324369/1 "2023-01-31T20:40:08Z")

</div>

I am trying to get the data from a log, however in the middle of the log there is a line break which prevents the Grok filter from reading it correctly. If I adjust it to a single line it works, however, it would require the line break to be found

How could you tell Grok that there will be a jump and take the following data?

This the log

```auto
{C-FLOW-ID-CAB APN101MQ C-OPERATION-CAB P T-EVENTO-CAB RUNNING T-EXTERNAL-ID-CAB null F-MESSAGE-CAB 20221018 H-MESSAGE-CAB 601006 C-MESSAGE-ID-CAB DC45D4AA6B3D0000 M-STATUS-CAB 02 
[<FOTO><Status>RUNNING</Status><EVENTO>2022101806:01:00.0</EVENTO></FOTO>]}

```

This is my grok filter

```auto
grok {
        match => { 'message' => '(?:[^:]+) %{WORD:C-FLOW-ID-CAB} (?:[^:]+) %{WORD:C-OPERATION-CAB} (?:[^:]+) %{WORD:T-EVENTO-CAB} (?:[^:]+) %{WORD:T-EXTERNAL-ID-CAB} (?:[^:]+) %{WORD:F-MESSAGE-CAB} (?:[^:]+) %{WORD:H-MESSAGE-CAB} (?:[^:]+) %{WORD:C-MESSAGE-ID-CAB} (?:[^:]+) %{WORD:M-STATUS-CAB} \[%{GREEDYDATA:DETAIL}\]'}
    }

```

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [January 31, 2023, 8:52pm UTC](https://discuss.elastic.co/t/line-break-in-grok-pattern/324369/2 "2023-01-31T20:52:38Z")

</div>

Can you show how the message looks like? A single line or two lines? Filebear or file should use multiline pattern or if is a single line remove \n from the message with gsub or add \n or .{1,3} in front `[<FOTO><Status>...`

`.{1,3}\[%{GREEDYDATA:DETAIL}\]`  
`\\n\[%{GREEDYDATA:DETAIL}\]`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 28, 2023, 8:52pm UTC](https://discuss.elastic.co/t/line-break-in-grok-pattern/324369/3 "2023-02-28T20:52:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.