# Logstash Grok Parsing multiple lines

**URL:** <https://discuss.elastic.co/t/logstash-grok-parsing-multiple-lines/359948>\
**Category:** Logstash\
**Created:** [May 22, 2024, 2:57am UTC](https://discuss.elastic.co/t/logstash-grok-parsing-multiple-lines/359948 "2024-05-22T02:57:50Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![iceman0410](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/iceman0410/32/134395_2.png) [@iceman0410](https://discuss.elastic.co/u/iceman0410)\
**Post date:** [May 22, 2024, 2:57am UTC](https://discuss.elastic.co/t/logstash-grok-parsing-multiple-lines/359948/1 "2024-05-22T02:57:50Z")

</div>

Hi everyone,  
I am new on GROK

I have a message log with multiple lines need to parse. Anyone please help me check my Grok and kindly give me advices. Thanks  
Log message:  
"INFO 2023-09-12 13:18:22,057 [[MuleRuntime].uber.273: [xss-threat-protection-policy-1418967-account-process-api-main].1418967-custom-policy.CPU\_LITE @60b7e8f3] [event: d8a4b770-516e-11ee-a886-0ac3dcacb5b1] org.mule.runtime.core.internal.processor.LoggerMessageProcessor: {  
""Correlation ID"": ""BOLUK2787ff9c-85cb-b84e-6c5e-abc9c94e2a91"",  
""Transaction ID"": ""BOLUK2787ff9c-85cb-b84e-6c5e-abc9c94e2a91"",  
""Application Name"": ""Account Process API"",  
""Date Time Stamp"": ""2023-09-12T13:18:22.056Z"",  
""request\_method"": ""GET"",  
""request\_path"": ""/internal/p/abt/v3.0/accounts/check-account"",  
""status"": ""STARTED"",  
""action"": ""API REQUEST RECEIVED"",  
""source"": null,  
""target"": null,  
""Headers"": {  
""x-api-source-system"": ""BOL"",  
""x-api-transaction-id"": ""BOLUK2787ff9c-85cb-b84e-6c5e-abc9c94e2a91"",  
""x-api-correlation-id"": ""BOLUK30f8d78b-d1e6-d7da-873b-fd57287d6f0d"",  
""x-correlation-id"": ""d8a4b770-516e-11ee-a886-0ac3dcacb5b1"",  
""host"": ""[api.process1.igz.sit2.bizint-sit3.boivip.net:9095](http://api.process1.igz.sit2.bizint-sit3.boivip.net:9095)"",  
""user-agent"": ""AHC/1.0"",  
""connection"": ""keep-alive"",  
""accept"": ""_/_"",  
""content-length"": ""0""  
},  
""query\_parameters"": ""iban=IE24BOFI90097315088957""  
}  
WARN 2023-09-21 20:53:44,453 [pool-11-thread-1] 2419346 com.mulesoft.agent.util.client.DefaultAuthenticationProxyClient: There was an error executing a post request to the auth proxy."

My Grok:  
%{LOGLEVEL:lvl}%{SPACE}%{TIMESTAMP\_ISO8601:dts}%{SPACE}%{GREEDYDATA:rest}

Grok debugger as picture can not get the rest of lines message

 ![12](https://us1.discourse-cdn.com/elastic/original/3X/c/2/c2c797037a8a9b479055285fc05e08dc87394edc.png)