# Multiline grok filter not working with specific log

**URL:** <https://discuss.elastic.co/t/multiline-grok-filter-not-working-with-specific-log/298923>\
**Category:** Logstash\
**Created:** [March 7, 2022, 12:20am UTC](https://discuss.elastic.co/t/multiline-grok-filter-not-working-with-specific-log/298923 "2022-03-07T00:20:24Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mihailo\_Stanarevic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mihailo_stanarevic/32/100807_2.png) [@Mihailo\_Stanarevic](https://discuss.elastic.co/u/Mihailo_Stanarevic)\
**Post date:** [March 7, 2022, 12:20am UTC](https://discuss.elastic.co/t/multiline-grok-filter-not-working-with-specific-log/298923/1 "2022-03-07T00:20:24Z")

</div>

Hello,  
I have logs that i have to process that look something like this

 ![Screenshot from 2022-03-07 00-23-07](https://us1.discourse-cdn.com/elastic/original/3X/4/2/42a5ed8eb72e4e67cf3b5e402a4985e8ce1c33bd.png)  
As far as my knowledge goes I have to set up logstash to support multiline logs so I created the following configuration

```auto
input {
	file {
		path => "/home/user/Desktop/Logs/ **/**"
		start_position => "beginning"
		codec => multiline {
			pattern => "^\[%{LOGLEVEL:log_level}\]"
			negate => true
			what => "previous"
	        }
	}
}

filter {
	grok {
		match => { "path" => "/(?<file_name>[^/]+).log" }
	}
	grok {
        match => {
            "message" => '(?m)\[%{LOGLEVEL:log_level}\] %{DATE_EU:date}. %{TIME:time} \(%{DATA:class}:%{GREEDYDATA:operation}\) Date and time: %{GREEDYDATA:full_date_and_time}\| miliseconds: %{NUMBER:millis}'
        }
    }
}

output {
	elasticsearch { 
		hosts => ["localhost:9200"] 
		index => "%{file_name}"
	}
  	stdout { codec => rubydebug }
}

```

As far as the log pattern goes, it matches the logs in the screenshot (Checked it on Kibana Grok Debugger). I want logstash to consider line 1 2 and 3 as one event, 4,5,6 as one event etc. Essentially when it sees [] to consider it as a whole separate event, and to consider everything that follows as the same event until it sees another []. Any ideas why this isn't working and what I could do to make it work?  
Thanks a lot in advance!

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 7, 2022, 2:25am UTC](https://discuss.elastic.co/t/multiline-grok-filter-not-working-with-specific-log/298923/2 "2022-03-07T02:25:31Z")

</div>

The events flushed by the multiline codec will include the line separators, so you will probably need `%{GREEDYDATA:operation}\)\nDate and time:`.

---

<div class="post-metadata">

**Author:** ![Mihailo\_Stanarevic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mihailo_stanarevic/32/100807_2.png) [@Mihailo\_Stanarevic](https://discuss.elastic.co/u/Mihailo_Stanarevic)\
**Post date:** [March 7, 2022, 8:42pm UTC](https://discuss.elastic.co/t/multiline-grok-filter-not-working-with-specific-log/298923/3 "2022-03-07T20:42:49Z")

</div>

That was it, thanks a lot!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 4, 2022, 8:42pm UTC](https://discuss.elastic.co/t/multiline-grok-filter-not-working-with-specific-log/298923/4 "2022-04-04T20:42:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.