# Logstash : parse multiple lines, each in one field in a single event
**URL:** https://discuss.elastic.co/t/logstash-parse-multiple-lines-each-in-one-field-in-a-single-event/138498
**Category:** Logstash
**Created:** [July 4, 2018, 7:28am UTC](https://discuss.elastic.co/t/logstash-parse-multiple-lines-each-in-one-field-in-a-single-event/138498 "2018-07-04T07:28:24Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Jeremie\_Myara](https://discuss.elastic.co/u/Jeremie_Myara)
#### Post date: [July 4, 2018, 7:28am UTC](https://discuss.elastic.co/t/logstash-parse-multiple-lines-each-in-one-field-in-a-single-event/138498/1 "2018-07-04T07:28:24Z")
Hi everyone,
According to this thread :[Multiline conf file to parse log file to elasticsearch - #5 by michaellizhou](https://discuss.elastic.co/t/multiline-conf-file-to-parse-log-file-to-elasticsearch/1153/5)
> The file input isn't meant to read entire files so you're sort of fighting the system here. I suggest you configure multiline to join the current line with the previous unless it matches the finish line. That should get Logstash to emit a logical line containing the whole files once it reaches the "test\_web\_events.py: FINISH: ..." line. I guess you won't get that line included in the message but that's probably not a problem.
He helped someone who wanted to parse multiple lines in a single event, and at this end he told him :
" I guess you won't get that line included in the message but that's probably not a problem."
But actually, it's my problem, I have all my lines in a single event but after that I want to put each line in a single field in the same event.
```
OccuredAt: 6/23/2018 01:24:04 AM
Message: Erreur lors du chargement de la DA : 125454
Location: (-1): .
LogLevel: Error
ManagedThreadId: 0
Logname: Ir.Logging
Username: SV_IS-SERV-DV
Machinename: DVMI03
AppDomain:
Identity:
```
and i give you my conf file :
```
OccuredAt: %{MONTHNUM}/%{MONTHDAY}/%{YEAR} %{TIME} (?:AM|PM)
Message: %{DATA:message}
Location: %{DATA:location}
LogLevel: %{NOTSPACE:loglevel}
ManagedThreadId: %{DATA:threadid}
Logname: %{NOTSPACE:logname}
Username: %{NOTSPACE:username}
Machinename: %{NOTSPACE:machinename}
AppDomain: %{DATA:appdomain}
Identity: %{DATA:identity}
```
Even after validate my pattern with Grokdebugger, it doesn't work when i used it in my config file. All the lines of this event are in the same message field but i can't be filtered correctly.
Please, can you explain how to do this, I can't figured it out.
Thanks a lot for your help,
Jérémie
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 4, 2018, 3:43pm UTC](https://discuss.elastic.co/t/logstash-parse-multiple-lines-each-in-one-field-in-a-single-event/138498/2 "2018-07-04T15:43:34Z")
There are several things that do not match in that pattern. "Machine Name" vs. "Machinename". "Log Name" vs. "Logname". "SV\_IS-SERV-DV" does not match "VINCIC-FR\%{NOTSPACE:username}". And that \ needs to be escaped or you will get a syntax error.
I suggest you start small with something like
```
grok {
match => [ "message", "OccuredAt: %{MONTHNUM}/%{MONTHDAY}/%{YEAR} %{TIME} (?:AM|PM)
Message: %{DATA:message}
" ]
```
then add one line to the grok pattern at a time and make sure each addition to the pattern works.
---
### Author:  [@Jeremie\_Myara](https://discuss.elastic.co/u/Jeremie_Myara)
#### Post date: [July 5, 2018, 8:36am UTC](https://discuss.elastic.co/t/logstash-parse-multiple-lines-each-in-one-field-in-a-single-event/138498/3 "2018-07-05T08:36:53Z")
Hi,
Thanks for your answer.
Even with your changes it does not work. I already try all these little possibilities before asking help to someone.
But I found the dissect filter that will help me to parse my data. [https://www.elastic.co/guide/en/logstash/5.0/plugins-filters-dissect.html](https://www.elastic.co/guide/en/logstash/5.0/plugins-filters-dissect.html)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 2, 2018, 8:36am UTC](https://discuss.elastic.co/t/logstash-parse-multiple-lines-each-in-one-field-in-a-single-event/138498/4 "2018-08-02T08:36:54Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.