# Logstash Grok New Line Syntax **URL:** \ **Category:** Logstash\ **Created:** [July 25, 2019, 1:00am UTC](https://discuss.elastic.co/t/logstash-grok-new-line-syntax/192148 "2019-07-25T01:00:11Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![userR](https://avatars.discourse-cdn.com/v4/letter/u/22d042/32.png) [@userR](https://discuss.elastic.co/u/userR)\ **Post date:** [July 25, 2019, 1:00am UTC](https://discuss.elastic.co/t/logstash-grok-new-line-syntax/192148/1 "2019-07-25T01:00:11Z")
Hi, I am attempting to parse log data that are on different lines. When its read through filebeat and sent to logstash, the message contains \n. Unfortunetly, I am unable to deal with this and am getting an error when I parse it like this: ![59%20PM](https://us1.discourse-cdn.com/elastic/original/3X/e/9/e938315aae32f4fbc1e096177336cb4c207bdb31.png) ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [July 25, 2019, 12:37pm UTC](https://discuss.elastic.co/t/logstash-grok-new-line-syntax/192148/2 "2019-07-25T12:37:59Z")
Use a literal newline in the configuration to match a multiline pattern, like [this](https://discuss.elastic.co/t/dissector-mapping-pattern-not-found/186509/2). ---
**Author:** ![userR](https://avatars.discourse-cdn.com/v4/letter/u/22d042/32.png) [@userR](https://discuss.elastic.co/u/userR)\ **Post date:** [July 25, 2019, 5:29pm UTC](https://discuss.elastic.co/t/logstash-grok-new-line-syntax/192148/3 "2019-07-25T17:29:54Z")
![51%20AM](https://us1.discourse-cdn.com/elastic/original/3X/3/5/354fc962d4a7fe0ac3e4a399a4bd9e8ae6dda286.png) The following doesn't work either. Is that what you meant? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [July 25, 2019, 5:59pm UTC](https://discuss.elastic.co/t/logstash-grok-new-line-syntax/192148/4 "2019-07-25T17:59:37Z")
If your events contain newline then you need a literal newline in the pattern. However, if your events contain \n then you would use \\n. ---
**Author:** ![userR](https://avatars.discourse-cdn.com/v4/letter/u/22d042/32.png) [@userR](https://discuss.elastic.co/u/userR)\ **Post date:** [July 25, 2019, 6:16pm UTC](https://discuss.elastic.co/t/logstash-grok-new-line-syntax/192148/5 "2019-07-25T18:16:57Z")
My event contains a literal newline. However, when I output my logstash output to the console, I see \n in the "message" field. I just adjusted my config syntax to this: ``` grok { match => [ "message", "(?[A-Z]{1}[a-z]{2} [0-9]{2}, [0-9]{4} [0-9]{1}:[0-9]{2}:[0-9]{2} [A-Z]{2}) %{NOTSPACE:requestpath} %{WORD:word} %{WORD:status}%{GREEDYDATA:data}", ``` This unfortunately does not correctly parse the data. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [July 25, 2019, 6:22pm UTC](https://discuss.elastic.co/t/logstash-grok-new-line-syntax/192148/6 "2019-07-25T18:22:11Z")
Shouldn't that be ``` grok { match => ["message", "(?[A-Z]{1}[a-z]{2} [0-9]{2}, [0-9]{4} [0-9]{1}:[0-9]{2}:[0-9]{2} [A-Z]{2}) %{NOTSPACE:requestpath} %{WORD:word} %{WORD:status}%{GREEDYDATA:data}", ``` ? ---
**Author:** ![userR](https://avatars.discourse-cdn.com/v4/letter/u/22d042/32.png) [@userR](https://discuss.elastic.co/u/userR)\ **Post date:** [July 25, 2019, 6:29pm UTC](https://discuss.elastic.co/t/logstash-grok-new-line-syntax/192148/7 "2019-07-25T18:29:13Z")
I believe either format works. Just adjusted to your format and it is still not being parsing correctly. However, I tried the //n and am having a tricky issue: ![47%20AM](https://us1.discourse-cdn.com/elastic/original/3X/f/2/f252279839a9c499bc8a9fc6c07cc22e1d8cab8b.png) However, this parses correctly if I take out status: ![48%20AM](https://us1.discourse-cdn.com/elastic/original/3X/4/4/44aa3a8a41bd3f6cd7827f84eb33a28cdc48bc35.png) edit: And when I do the following, I get a grokparsefailure: `"message", "(?[A-Z]{1}[a-z]{2} [0-9]{2}, [0-9]{4} [0-9]{1}:[0-9]{2}:[0-9]{2} [A-Z]{2}) %{NOTSPACE:requestpath} %{WORD:word}\\n%{GREEDYDATA:data}"` It parses correctly up until the \n. So while the grok debugger is showing that it should be parsing correctly, it actually is not occuring when I run logstash ☹ ---
**Author:** ![userR](https://avatars.discourse-cdn.com/v4/letter/u/22d042/32.png) [@userR](https://discuss.elastic.co/u/userR)\ **Post date:** [July 25, 2019, 7:44pm UTC](https://discuss.elastic.co/t/logstash-grok-new-line-syntax/192148/8 "2019-07-25T19:44:03Z")
![30%20PM](https://us1.discourse-cdn.com/elastic/original/3X/3/1/31151e22edf94aaaef1cef82800f67b8f714ed2f.png) This is also another configuration that works in the debugger, but not when I run logstash ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [July 25, 2019, 8:37pm UTC](https://discuss.elastic.co/t/logstash-grok-new-line-syntax/192148/9 "2019-07-25T20:37:06Z")
What is the text you are trying to match against? ---
**Author:** ![userR](https://avatars.discourse-cdn.com/v4/letter/u/22d042/32.png) [@userR](https://discuss.elastic.co/u/userR)\ **Post date:** [July 25, 2019, 8:55pm UTC](https://discuss.elastic.co/t/logstash-grok-new-line-syntax/192148/10 "2019-07-25T20:55:44Z")
Mar 05, 2019 3:23:14 AM pluggin word\nWARNING: datadata I ended up using gsub to drop "\n" and replace it with a space. From there, I was able to configure a pattern that worked. `"message", "(?[A-Z]{1}[a-z]{2} [0-9]{2}, [0-9]{4} [0-9]{1}:[0-9]{2}:[0-9]{2} [A-Z]{2}) %{NOTSPACE:requestpath} %{WORD:word} %{WORD:status}: %{GREEDYDATA:data}",` Still a little weird as to why the debugger would say it was parsed correctly while logstash would throw a grokparsefailure error. Anyways, appreciate the help. Here is the mutate gsub I used for reference. `mutate {gsub =>["message", "[\n]"," "]}` ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [July 25, 2019, 9:05pm UTC](https://discuss.elastic.co/t/logstash-grok-new-line-syntax/192148/11 "2019-07-25T21:05:03Z")
Do you have config.support\_escapes enabled? Anyways, I think the problem was the trailing space at the end of the first line of your pattern. ---
**Author:** ![userR](https://avatars.discourse-cdn.com/v4/letter/u/22d042/32.png) [@userR](https://discuss.elastic.co/u/userR)\ **Post date:** [July 25, 2019, 9:11pm UTC](https://discuss.elastic.co/t/logstash-grok-new-line-syntax/192148/12 "2019-07-25T21:11:29Z")
That seems to be the issue, I had it set to false. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 22, 2019, 9:11pm UTC](https://discuss.elastic.co/t/logstash-grok-new-line-syntax/192148/13 "2019-08-22T21:11:47Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.