# Logstash skips first lines and start reading from second line
**URL:** https://discuss.elastic.co/t/logstash-skips-first-lines-and-start-reading-from-second-line/302121
**Category:** Logstash
**Created:** [April 11, 2022, 2:56pm UTC](https://discuss.elastic.co/t/logstash-skips-first-lines-and-start-reading-from-second-line/302121 "2022-04-11T14:56:26Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Pranjal\_Sett](https://discuss.elastic.co/u/Pranjal_Sett)
#### Post date: [April 11, 2022, 2:56pm UTC](https://discuss.elastic.co/t/logstash-skips-first-lines-and-start-reading-from-second-line/302121/1 "2022-04-11T14:56:26Z")
Hi All,
This is below my sample logs.
[2022-03-09T22:38:03.296+01:00] [String] [NOTIFICATION:16] [ODL-52001] [FileLogWriter] [Oracle] [host: \*] [nwaddr: \*] [tid: [ACTIVE].ExecuteThread: '157' for queue: 'weblogic.kernel.Default (self-tuning)'] [userId: \*] deleting log file: diagnostic-42.log, size: 10481909 bytes
[2022-03-09T22:38:03.214+01:00] [STR1] [NOTIFICATION] [logging] [tid: \*] [userId:] [ecid: \*,0:10] [APP: soa] [partition-name: D] [tenant-name: G] [WSM\_ServiceID: \*] [FlowId: \*] [policy] [WSM\_LogType: Request] [[XML details]]
So I don't want this first line which is starting [2022-03-09T22:38:03.296+01:00] [String] [NOTIFICATION:16]..... want to drop it and want to keep from second line which is starting [2022-03-09T22:38:03.214+01:00] [STR1] [NOTIFICATION] [logging].......
So, how can I achieve this in logstash.. Shall I write multiple match pattern and drop the first message?
---
### Author:  [@Pranjal\_Sett](https://discuss.elastic.co/u/Pranjal_Sett)
#### Post date: [April 12, 2022, 9:27am UTC](https://discuss.elastic.co/t/logstash-skips-first-lines-and-start-reading-from-second-line/302121/2 "2022-04-12T09:27:50Z")
@magnusbaeck , Can you please suggest on that?
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [April 12, 2022, 12:09pm UTC](https://discuss.elastic.co/t/logstash-skips-first-lines-and-start-reading-from-second-line/302121/3 "2022-04-12T12:09:25Z")
If you do not want a line in your output, you will need to drop it someway.
To do that in Logstash you need a string or field with a specific value to drop that line.
So if you want to drop multiple lines you need to have some common value on those lines or write a conditional that match each one of them.
For example, you can drop something with the following configuration in the filter block.
```auto
if "string to match" in [message] { drop {} }
```
---
### Author:  [@Pranjal\_Sett](https://discuss.elastic.co/u/Pranjal_Sett)
#### Post date: [April 12, 2022, 12:23pm UTC](https://discuss.elastic.co/t/logstash-skips-first-lines-and-start-reading-from-second-line/302121/4 "2022-04-12T12:23:49Z")
Hello @leandrojmp ,
Yes... It worked.. Thanks a lot.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 10, 2022, 12:24pm UTC](https://discuss.elastic.co/t/logstash-skips-first-lines-and-start-reading-from-second-line/302121/5 "2022-05-10T12:24:12Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.