# Multiline grok problem
**URL:** https://discuss.elastic.co/t/multiline-grok-problem/51608
**Category:** Logstash
**Created:** [June 1, 2016, 7:50pm UTC](https://discuss.elastic.co/t/multiline-grok-problem/51608 "2016-06-01T19:50:12Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@James\_Beal](https://discuss.elastic.co/u/James_Beal)
#### Post date: [June 1, 2016, 7:50pm UTC](https://discuss.elastic.co/t/multiline-grok-problem/51608/1 "2016-06-01T19:50:12Z")
I am reading in the mysql slow log with a multiline filebeat, I would like to parse it in logstash. My log line looks like:
```
# Time: 160601 19:29:43
# User@Host: root[root] @ localhost [] Id: 1055005
# Schema: Last_errno: 0 Killed: 0
# Query_time: 10.000128 Lock_time: 0.000000 Rows_sent: 1 Rows_examined: 0 Rows_affected: 0
# Bytes_sent: 64
SET timestamp=1464809383;
SELECT SLEEP(10);
```
And my match looks like
```
match => { "message" => "# Time:%{GREEDYDATA:time_message} # User@Host: %{GREEDYDATA:mysql_user} @ %{GREEDYDATA:mysql_client} Id: %{GREEDYDATA:mysql_id} # Schema: %{GREEDYDATA:mysql_schema} Last_errno: %{GREEDYDATA:mysql_errorno} Killed: %{GREEDYDATA:mysql_killed} # Query_time: %{GREEDYDATA:mysql_query_time} Lock_time: %{GREEDYDATA:mysql_lock_time} Rows_sent: %{GREEDYDATA:mysql_rows_sent} Rows_examined: %{GREEDYDATA:mysql_rows_examined} Rows_affected: %{GREEDYDATA:mysql_rows_affected} # Bytes_sent: %{GREEDYDATA:mysql_bytes_sent} SET timestamp=%{GREEDYDATA:mysql_timestamp}; %{GREEDYDATA:mysql_query}" }
```
Do I need to match the end of lines ? and if so how ?
For reference the multiline reading in filebeat is
```
paths:
- /home/galera/log/mysql-slow.log
multiline:
pattern: ^# Time
negate: true
match: after
timeout: 5s
input_type: log
document_type: mysql-slow-log
```
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 2, 2016, 6:26am UTC](https://discuss.elastic.co/t/multiline-grok-problem/51608/2 "2016-06-02T06:26:58Z")
I'd try `\n` or `\s` to match the newlines. They won't be removed by Filebeat so the string seen by the grok filter will be "# Time: 160601 19:29:43\n# User@Host: ...".
---
### Author:  [@James\_Beal](https://discuss.elastic.co/u/James_Beal)
#### Post date: [June 2, 2016, 5:43pm UTC](https://discuss.elastic.co/t/multiline-grok-problem/51608/3 "2016-06-02T17:43:25Z")
That is perfect thank you.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:54am UTC](https://discuss.elastic.co/t/multiline-grok-problem/51608/4 "2017-07-06T04:54:42Z")