# \[Need Help\] Multiple pattern in one log file

**URL:** <https://discuss.elastic.co/t/need-help-multiple-pattern-in-one-log-file/25357>\
**Category:** Logstash\
**Created:** [July 11, 2015, 4:40am UTC](https://discuss.elastic.co/t/need-help-multiple-pattern-in-one-log-file/25357 "2015-07-11T04:40:05Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![SiegeLion](https://avatars.discourse-cdn.com/v4/letter/s/258eb7/32.png) [@SiegeLion](https://discuss.elastic.co/u/SiegeLion)\
**Post date:** [July 11, 2015, 4:40am UTC](https://discuss.elastic.co/t/need-help-multiple-pattern-in-one-log-file/25357/1 "2015-07-11T04:40:05Z")

</div>

I am trying to send xtreemfs log files to logstash and parse them into elastic search

A problem with xtreemfs log files is that they begin with some thing like

########### Configuration ###########  
# Stuff  
# More Stuff  
# More stuff  
# Even more stuff  
### End of configuration stuff

[I | Data | Data | data | Data] Message  
[I | Data | Data | data | Data] Message  
[I | Data | Data | data | Data] Message  
[I | Data | Data | data | Data] Message  
[I | Data | Data | data | Data] Message

As you can see, two different patterns exist in one log file.

Is there a way for me to group the line beginning with # together in one single event? And then parse the rest of logs beginning with [ using another grok?  
What is the proper way to handle this? I am using logstash 1.4.2.  
Is parsing some thing like this well supported in logstash?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [July 11, 2015, 4:54am UTC](https://discuss.elastic.co/t/need-help-multiple-pattern-in-one-log-file/25357/2 "2015-07-11T04:54:26Z")

</div>

If the lines begin in #, you can do a conditional and then drop them entirely.

---

<div class="post-metadata">

**Author:** ![SiegeLion](https://avatars.discourse-cdn.com/v4/letter/s/258eb7/32.png) [@SiegeLion](https://discuss.elastic.co/u/SiegeLion)\
**Post date:** [July 11, 2015, 5:03am UTC](https://discuss.elastic.co/t/need-help-multiple-pattern-in-one-log-file/25357/3 "2015-07-11T05:03:25Z")

</div>

I don't want to drop them.

I still want to group them together and show them as one event.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [July 11, 2015, 5:05am UTC](https://discuss.elastic.co/t/need-help-multiple-pattern-in-one-log-file/25357/4 "2015-07-11T05:05:24Z")

</div>

Then you will want to do a conditional but with a mutliline filter/codec.

---

<div class="post-metadata">

**Author:** ![SiegeLion](https://avatars.discourse-cdn.com/v4/letter/s/258eb7/32.png) [@SiegeLion](https://discuss.elastic.co/u/SiegeLion)\
**Post date:** [July 11, 2015, 5:50am UTC](https://discuss.elastic.co/t/need-help-multiple-pattern-in-one-log-file/25357/5 "2015-07-11T05:50:36Z")

</div>

Hey Mark! Thanks for the great help.

I was able to group the # logs together with this codec under file input.

```
codec => multiline {
  pattern => "^\["
  negate => true
  what => previous
}

```

Now the multiline events are nicely tagged with "multiline" and allow me to do further processing if needed!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:34am UTC](https://discuss.elastic.co/t/need-help-multiple-pattern-in-one-log-file/25357/6 "2017-07-06T05:34:57Z")

</div>

Closed on July 6, 2017, 5:34am UTC