# Logstash reads only one line

**URL:** https://discuss.elastic.co/t/logstash-reads-only-one-line/174095
**Category:** Logstash
**Created:** [March 27, 2019, 10:43am UTC](https://discuss.elastic.co/t/logstash-reads-only-one-line/174095 "2019-03-27T10:43:49Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![angham](https://avatars.discourse-cdn.com/v4/letter/a/f6c823/32.png) [@angham](https://discuss.elastic.co/u/angham)
#### Post date: [March 27, 2019, 10:43am UTC](https://discuss.elastic.co/t/logstash-reads-only-one-line/174095/1 "2019-03-27T10:43:49Z")

</div>

we need to filter the select query but logstash reads just this line :

15:49:05,479 DEBUG [org.hibernate.stat.internal.ConcurrentStatisticsImpl] (default task-43) HHH000117: HQL: select T from translator\_MenuTranslator T where (T.codeMessage = ?1 and (T.language = ?2 and (T.label = ?3 and T.label = ?4))), time: 2ms, rows: 0

and i need to filter for exemple this two lines:

15:49:05,479 DEBUG [org.hibernate.stat.internal.ConcurrentStatisticsImpl] (default task-43) HHH000117: HQL: select T from translator\_MenuTranslator T where (T.codeMessage = ?1 and (T.language = ?2 and (T.label = ?3 and T.label = ?4))), time: 2ms, rows: 0  
15:49:01,193 DEBUG [org.hibernate.stat.internal.ConcurrentStatisticsImpl] (default task-39) HHH000117: HQL: select T from translator\_UseCaseTitle T where (T.language = ?1 and (T.className = ?2 and T.useCaseName = ?3)), time: 5ms, rows: 0

here is my filter:

filter{  
grok { match =\> ["message", "%{TIME:timestamp}\s%{LOGLEVEL:level} [%{JAVACLASS:class}]\s(%{GREEDYDATA:thread}) HHH000117: HQL: %{GREEDYDATA:[@metadata][text]}" ]}  
if [type] == "logs" {  
dissect { mapping =\> ["message", '%{[@metadata][ts]} [%{}] [%{}] %{[@metadata][text]}' ]}}  
mutate { add\_field =\> { "[@metadata][static]" =\> "1" } }  
if [@metadata][text] =~ /^select/ {  
grok { match =\> ["[@metadata][text]", "select T from %{GREEDYDATA:tableName}T where (T.codeMessage = ?%{NOTSPACE}1 and (T.language = ?%{NOTSPACE}2 and (T.label = ?%{NOTSPACE}3 and T.label = ?%{NOTSPACE}4))), time:\s%{GREEDYDATA:duration}\ms,\s%{GREEDYDATA:rows}" ]}  
aggregate {  
task\_id =\> "%{[@metadata][static]}"  
code =\> "map['id'] = event.get(time);"  
}

```
 }

```

if "\_grokparsefailure" in [tags] {  
drop{}  
}  
}

where is the problem !!!!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 24, 2019, 10:43am UTC](https://discuss.elastic.co/t/logstash-reads-only-one-line/174095/2 "2019-04-24T10:43:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.