# Multiline Pattern for Logs in Kibana **URL:** \ **Category:** Logstash\ **Created:** [July 23, 2019, 7:32am UTC](https://discuss.elastic.co/t/multiline-pattern-for-logs-in-kibana/191757 "2019-07-23T07:32:54Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![sumit-kashyap](https://avatars.discourse-cdn.com/v4/letter/s/ebca7d/32.png) [@sumit-kashyap](https://discuss.elastic.co/u/sumit-kashyap)\ **Post date:** [July 23, 2019, 7:32am UTC](https://discuss.elastic.co/t/multiline-pattern-for-logs-in-kibana/191757/1 "2019-07-23T07:32:54Z")
Can you please help me to how I can see my logs in different lines differ by minutes and seconds. My logs are as under: Jul 22, 2019 1:23:05 PM org.apache.catalina.startup.HostConfig deployDirectory INFO: Deploying web application directory /usr/local/tomcat-7.0.42/webapps/Demo\_Portal-hook Jul 22, 2019 1:23:07 PM org.apache.catalina.startup.HostConfig deployDirectory INFO: Deploying web application directory /usr/local/tomcat-7.0.42/webapps/Demo\_ManageUsers-portlet Jul 22, 2019 1:23:10 PM org.apache.catalina.startup.HostConfig deployDirectory INFO: Deploying web application directory /usr/local/tomcat-7.0.42/webapps/Demo\_ServiceManagement-portlet Groc pattern: grok { match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:application\_timestamp} %{WORD:severity} %{GREEDYDATA:application\_message}" } } Now my logs are coming in Kibana as: Jul 22, 2019 1:23:52 PM org.apache.catalina.startup.HostConfig deployDirectory INFO: Deploying web application directory /usr/local/tomcat-7.0.42/webapps/Demo\_Theme-theme Jul 22, 2019 1:23:55 PM org.apache.catalina.startup.HostConfig deployDirectory INFO: Deploying web application directory /usr/local/tomcat-7.0.42/webapps/Demo\_Network But I want them in multiple lines for every second. Also I want to club the messages starting from At ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [July 23, 2019, 3:34pm UTC](https://discuss.elastic.co/t/multiline-pattern-for-logs-in-kibana/191757/2 "2019-07-23T15:34:29Z")
> [@sumit-kashyap](#): > > Jul 22, 2019 1:23:05 PM org.apache.catalina.startup.HostConfig deployDirectory > INFO: Deploying web application directory /usr/local/tomcat-7.0.42/webapps/Demo\_Portal-hook > Jul 22, 2019 1:23:07 PM org.apache.catalina.startup.HostConfig deployDirectory > INFO: Deploying web application directory /usr/local/tomcat-7.0.42/webapps/Demo\_ManageUsers-portlet > Jul 22, 2019 1:23:10 PM org.apache.catalina.startup.HostConfig deployDirectory > INFO: Deploying web application directory /usr/local/tomcat-7.0.42/webapps/Demo\_ServiceManagement-portlet Is that 3 lines or 6? ---
**Author:** ![sumit-kashyap](https://avatars.discourse-cdn.com/v4/letter/s/ebca7d/32.png) [@sumit-kashyap](https://discuss.elastic.co/u/sumit-kashyap)\ **Post date:** [July 24, 2019, 7:04am UTC](https://discuss.elastic.co/t/multiline-pattern-for-logs-in-kibana/191757/3 "2019-07-24T07:04:59Z")
These are 3 logs starting with timestamp differ by seconds. I want to see them in different lines. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [July 24, 2019, 12:25pm UTC](https://discuss.elastic.co/t/multiline-pattern-for-logs-in-kibana/191757/4 "2019-07-24T12:25:42Z")
Try ``` grok { pattern_definitions => { "CUSTOMTS" => "%{MONTH} %{MONTHDAY}, %{YEAR} %{TIME} (AM|PM)" } match => { "message" => "%{CUSTOMTS:application_timestamp} %{JAVACLASS:class} %{WORD:something} %{LOGLEVEL:level}: %{GREEDYDATA:application_message}" } } ``` ---
**Author:** ![sumit-kashyap](https://avatars.discourse-cdn.com/v4/letter/s/ebca7d/32.png) [@sumit-kashyap](https://discuss.elastic.co/u/sumit-kashyap)\ **Post date:** [July 25, 2019, 7:24am UTC](https://discuss.elastic.co/t/multiline-pattern-for-logs-in-kibana/191757/5 "2019-07-25T07:24:15Z")
Not working for me. ![new-groc](https://us1.discourse-cdn.com/elastic/original/3X/9/5/956d4f9bfb94a2dd005773675901812ecdd03ccc.png) My current logs are coming in this format. I want them to arrange in better way i.e logs starting from at in different lines with no space in starting. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [July 25, 2019, 1:07pm UTC](https://discuss.elastic.co/t/multiline-pattern-for-logs-in-kibana/191757/6 "2019-07-25T13:07:41Z")
That is a completely different format to the other examples you gave, so you will need a different grok pattern. ---
**Author:** ![sumit-kashyap](https://avatars.discourse-cdn.com/v4/letter/s/ebca7d/32.png) [@sumit-kashyap](https://discuss.elastic.co/u/sumit-kashyap)\ **Post date:** [July 25, 2019, 1:27pm UTC](https://discuss.elastic.co/t/multiline-pattern-for-logs-in-kibana/191757/7 "2019-07-25T13:27:36Z")
Can you please give some idea? Do I need to change multiline pattern in filebeat I have changed my Conversion Pattern to get the logs in timestamp format. Actually I need that it should read logs according to timestamp as I had shown in logs , starting with Jul 22, 2019 1:23:05 PM ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 22, 2019, 1:27pm UTC](https://discuss.elastic.co/t/multiline-pattern-for-logs-in-kibana/191757/8 "2019-08-22T13:27:38Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.