# Multiline parsing error
**URL:** https://discuss.elastic.co/t/multiline-parsing-error/257774
**Category:** Logstash
**Created:** [December 6, 2020, 12:31pm UTC](https://discuss.elastic.co/t/multiline-parsing-error/257774 "2020-12-06T12:31:06Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Muhammad\_Faisal](https://discuss.elastic.co/u/Muhammad_Faisal)
#### Post date: [December 6, 2020, 12:31pm UTC](https://discuss.elastic.co/t/multiline-parsing-error/257774/1 "2020-12-06T12:31:06Z")
hi all,
i am using multiline to parse below log format...1 log entry is separated by either line which appears as "!-----New----------" or "------------!" ..... i am using below regex ,although its segregating log entries but in the "message" field its also sending the regex pattern lines "!-----New----------" or "------------!" ...how to make sure multiline shall only send "key:value" in message field
```auto
pattern => "(^!-+.*?-+)|(-+!)"
negate => true
what => "previous"
}
grok {
`match => { "message" => "%{GREEDYDATA:logs}"}
}
```
!----- New ---------------------------------------------------------------
key : value
key : value
key : value
!----- Event ---------------------------------------------------------------
key : value
key : value
key : value
---------------------------------------------------------------------------!
!----- New ---------------------------------------------------------------
key : value
key : value
key : value
---------------------------------------------------------------------------!
!----- New ---------------------------------------------------------------
Output:
"message" =\> "!----- New ----------------------------------------\n Key:value
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [December 6, 2020, 3:46pm UTC](https://discuss.elastic.co/t/multiline-parsing-error/257774/2 "2020-12-06T15:46:55Z")
> [@Muhammad\_Faisal](#):
>
> how to make sure multiline shall only send "key:value" in message field
That is not possible. The multiline codec combines the lines in a file, it does not modify them.
You can use mutate+gsub to remove text from the message field. For example
mutate { gsub =\> ["message", "^!-+New-+", ""] }
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 3, 2021, 3:47pm UTC](https://discuss.elastic.co/t/multiline-parsing-error/257774/3 "2021-01-03T15:47:00Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.