# Multine: Divide an email with a number of jobs in multiple events

**URL:** <https://discuss.elastic.co/t/multine-divide-an-email-with-a-number-of-jobs-in-multiple-events/128864>\
**Category:** Logstash\
**Created:** [April 20, 2018, 11:26am UTC](https://discuss.elastic.co/t/multine-divide-an-email-with-a-number-of-jobs-in-multiple-events/128864 "2018-04-20T11:26:50Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Swantje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/swantje/32/30244_2.png) [@Swantje](https://discuss.elastic.co/u/Swantje)\
**Post date:** [April 20, 2018, 11:26am UTC](https://discuss.elastic.co/t/multine-divide-an-email-with-a-number-of-jobs-in-multiple-events/128864/1 "2018-04-20T11:26:50Z")

</div>

Hey everyone,

I have got some **questions about grok pattern and multiline**.  
My **Input** is an **email from an Mailbox**.

This email is composed of multiple Jobs, but logstash takes it as one single event.  
I like to divide this event into a number of Events per every single Job.  
But it doesn't works when i try to divide the email...

**Then the first Job Begins:**

"Export: Release 11.2.0.4.0 - Production on Mon Apr 16 01:15:01 2018  
Copyright (c) 1982, 2011, Oracle and/or its affiliates. All rights reserved.  
...  
PARFILE...  
...  
Job "SYSTEM"."SYS\_EXPORT\_SCHEMA\_01" successfully completed at Mon Apr 16 01:15:44 2018 elapsed 0 00:00:42"

**The second Job:**

"Export: Release 11.2.0.4.0 - Production on Mon Apr 16 01:15:45 2018  
Copyright (c) 1982, 2011, Oracle and/or its affiliates. All rights reserved.  
...  
PARFILE  
Job "SYSTEM"."SYS\_EXPORT\_SCHEMA\_01" successfully completed at Mon Apr 16 01:17:57 2018 elapsed 0 00:02:12"

and so on..

The number of jobs in an email isn't fix!

**This is the Content of my logstash.conf** :

input {

```
imap {...
		}	
	
stdin {
	codec => multiline {
		pattern => "Export:Release"
		negate => "true"
		what => "previous"
	}	
}	

```

}

filter {

#this grok ist for an other email  
grok {  
match =\> {"message" =\>["%{UNIXPATH:path} version 2 for %{DATA:database} on time %{DATA:date}"]  
}

```
grok { 	
	match => {"message" =>["Export:Release %{GREEDYDATA:unimportant} PARFILE= %{UNIXPATH:path} %{GREEDYDATA:unimportant2} Job %{DATA:job} %{DATA:status} at %{DATA:date} elapsed 0 %{(?<duration_dp>[0-23]:[0-59]:[0-59]):duration}"]
}

```

#this grok ist for an other email  
grok {  
match =\> {"message" =\>["ERROR: RMAN backup for %{DATA:database} was %{GREEDYDATA:status}"]  
}

#this grok ist for an other email   
grok {  
match =\> {"message" =\>["%{(?\<timestamp\_rman\>%{YEAR}-%{MONTHNUM}-%{MONTHDAY}[T \_]%{HOUR}:?%{MINUTE}(?::?%{SECOND})?):timestamp} %{DATA:Start} .\*"]  
}  
}

output {  
...  
}

Please someone can help me?!

Thank you very much & many greetings  
Swantje

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 18, 2018, 11:26am UTC](https://discuss.elastic.co/t/multine-divide-an-email-with-a-number-of-jobs-in-multiple-events/128864/2 "2018-05-18T11:26:54Z")

</div>

Closed on May 18, 2018, 11:26am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.