# Multiline log problem

**URL:** <https://discuss.elastic.co/t/multiline-log-problem/159297>\
**Category:** Logstash\
**Created:** [December 4, 2018, 6:45am UTC](https://discuss.elastic.co/t/multiline-log-problem/159297 "2018-12-04T06:45:27Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![trelo](https://avatars.discourse-cdn.com/v4/letter/t/e19adc/32.png) [@trelo](https://discuss.elastic.co/u/trelo)\
**Post date:** [December 4, 2018, 6:45am UTC](https://discuss.elastic.co/t/multiline-log-problem/159297/1 "2018-12-04T06:45:27Z")

</div>

Hi,

I've logs like this:

```auto
{20151003010443,D,
{1,1},61,62,5,761520333,6,L,"SOME TEXT 1",1,
{"P",
{6,
{"S","SOME TEXT 2"},
{"S","SOME TEXT 3"}
}
},"",5,13,13,894575181,1,
{1}
}

```

I wrote and tested grok filter with Kibana grok debugger.

```auto
{%{DATESTAMP_EVENTLOG:date},%{GREEDYDATA:transaction-status},
{%{GREEDYDATA:transaction},%{GREEDYDATA:transaction-num}},%{INT:user},%{INT:computer-name},%{INT:application},%{INT:connection-num},%{INT:event-id},%{DATA:event-type},"%{TRULYGREEDY:comment}%{INT:metadata-id},
{"P",
{6,
%{GREEDYDATA:array1},
%{GREEDYDATA:array2}
}
},%{DATA:data-string}",%{INT:server-id},%{INT:main-port},%{INT:second-port},%{INT:session},%{INT:string-length},
%{GREEDYDATA:last-aray}
}

>>TRULYGREEDY (?<message>(.|\r|\n)*?(",))

```

Text in "SOME TEXT 1" can be up to 1000 strings.

So, I put grok filter into logstash config as is, but it doesn't seem to work.

```auto
filter {
  if [type] == "external1" {
        grok {
      patterns_dir => "/etc/logstash/patterns"
      match => {"message" => ['{%{DATESTAMP_EVENTLOG:date},%{GREEDYDATA:transaction-status},
                              {%{GREEDYDATA:trasaction},%{GREEDYDATA:trasaction-num}},%{INT:user},%{INT:computer-name},%{INT:application},%{INT:connection-num},%{INT:event-id},%{DATA:event-type},"%{TRULYGREEDY:comment}%{INT:metadata-id},
                              {"P",
                              {6,
                              %{GREEDYDATA:array1},
                              %{GREEDYDATA:array2}
                              }
                              },%{DATA:data-string}",%{INT:server-id},%{INT:main-port},%{INT:second-port},%{INT:session},%{INT:string-length},
                              %{GREEDYDATA:last-aray}
                              }'
                  ]}
    }
  }
}

```

Where I was wrong?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 1, 2019, 6:57am UTC](https://discuss.elastic.co/t/multiline-log-problem/159297/2 "2019-01-01T06:57:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.