# Logstash - parsing data for more than one alerts in a single message
**URL:** https://discuss.elastic.co/t/logstash-parsing-data-for-more-than-one-alerts-in-a-single-message/54114
**Category:** Logstash
**Created:** [June 28, 2016, 6:47am UTC](https://discuss.elastic.co/t/logstash-parsing-data-for-more-than-one-alerts-in-a-single-message/54114 "2016-06-28T06:47:57Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@bhawanaus](https://discuss.elastic.co/u/bhawanaus)
#### Post date: [June 28, 2016, 6:47am UTC](https://discuss.elastic.co/t/logstash-parsing-data-for-more-than-one-alerts-in-a-single-message/54114/1 "2016-06-28T06:47:57Z")
I've a scenario where I've to parse logs in logstash and create some visualizations. Below is an example log ..
25 Jun 2016 20:53:10,674 [http-bio-8080-exec-20] INFO com.employee.controller.EmloyeeController - [2016-06-25 20:53:10.087] [14115] [2016-06-25 21:00:11.0] [14840] [2016-06-25 21:00:11.0] [15627] [2016-06-25 21:00:11.0] [2016-06-25 20:53:10.674]
_ **log description** _
DateTime [Thread Name] LogLevel ClassName - [Altert Start Time Stamp] [EmpId 1] [Trans Time Stamp] [EmpId 2] [Trans Time Stamp] [EmpId 3] [Trans Time Stamp] [Alter End Time Stamp]
**One message can have 'n' number of alerts in it i.e (Employee ID and Trans Time stamp). I'm unable to create grok pattern for such scenario where one message can have more than one alerts.**
\*\*Secondly, for every log I've to calculate upstream time i.e [Trans Time Stamp - Altert Start Time Stamp =\> Upstream Time Taken] to plot graphs from it \*\*
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:50am UTC](https://discuss.elastic.co/t/logstash-parsing-data-for-more-than-one-alerts-in-a-single-message/54114/2 "2017-07-06T04:50:42Z")