# Multi line filter in logstash conf

**URL:** <https://discuss.elastic.co/t/multi-line-filter-in-logstash-conf/88035>\
**Category:** Logstash\
**Created:** [June 2, 2017, 8:38am UTC](https://discuss.elastic.co/t/multi-line-filter-in-logstash-conf/88035 "2017-06-02T08:38:48Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Aylwinns\_Tan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aylwinns_tan/32/20038_2.png) [@Aylwinns\_Tan](https://discuss.elastic.co/u/Aylwinns_Tan)\
**Post date:** [June 2, 2017, 8:38am UTC](https://discuss.elastic.co/t/multi-line-filter-in-logstash-conf/88035/1 "2017-06-02T08:38:48Z")

</div>

Hi all, i'm trying to build a logstash.conf file for the following type of log files.

Below is excerpt of an two events:

----Event 1----  
Exception at 21 May 2017  
(tab)Module: 6764  
(tab)Level: Abort  
(tab)Code: 83hdjwuyeb68g  
XmlDescription: None  
----End----  
----Event 2----  
Exception at 20 May 2017  
(tab)Module: 682  
(tab)Level: Abort  
(tab)Code: 683hhshvaaj67  
Responsible configuration:  
(tab)Global template: 107  
(tab)Xml Description: None  
----End-----

Both events appear in the same log, currently im using multiline with pattern ^\t and what previous.

But the issue is for the second event, the line one Responsible configuration does not have a tab.

Wondering if it's possible to use start with Exception as the start of a new event??  
If yes, how? I have tried ^E but doesn't seem to work.  
If no, anyone have any ideas on how i can do it?

Thanks

---

<div class="post-metadata">

**Author:** ![guyboertje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guyboertje/32/31592_2.png) [@guyboertje](https://discuss.elastic.co/u/guyboertje)\
**Post date:** [June 2, 2017, 9:03am UTC](https://discuss.elastic.co/t/multi-line-filter-in-logstash-conf/88035/2 "2017-06-02T09:03:16Z")

</div>

You could try using pattern: `----End----` negate: true and what: previous. Then `mutate gsub` the `----Event \d+----` away.

---

<div class="post-metadata">

**Author:** ![Aylwinns\_Tan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aylwinns_tan/32/20038_2.png) [@Aylwinns\_Tan](https://discuss.elastic.co/u/Aylwinns_Tan)\
**Post date:** [June 2, 2017, 5:03pm UTC](https://discuss.elastic.co/t/multi-line-filter-in-logstash-conf/88035/3 "2017-06-02T17:03:21Z")

</div>

thanks

I got it to work

^^

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 30, 2017, 5:03pm UTC](https://discuss.elastic.co/t/multi-line-filter-in-logstash-conf/88035/4 "2017-06-30T17:03:29Z")

</div>

Closed on June 30, 2017, 5:03pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.