# Need help with grok expression logstash

**URL:** https://discuss.elastic.co/t/need-help-with-grok-expression-logstash/375313
**Category:** Logstash
**Tags:** elastic-stack-monitoring
**Created:** [March 3, 2025, 1:49pm UTC](https://discuss.elastic.co/t/need-help-with-grok-expression-logstash/375313 "2025-03-03T13:49:10Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Mohamed\_NOUISSEL](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mohamed_nouissel/32/141755_2.png) [@Mohamed\_NOUISSEL](https://discuss.elastic.co/u/Mohamed_NOUISSEL)
#### Post date: [March 3, 2025, 1:49pm UTC](https://discuss.elastic.co/t/need-help-with-grok-expression-logstash/375313/1 "2025-03-03T13:49:10Z")

</div>

Hello,  
I am new to Logstash and Grok filters. My sample logs of glassfish server look like this:

```auto
  [2025-03-02T17:17:00.722133Z] [GF 7.0.12] [INFO] [] [jakarta.enterprise.logging.stdout] [tid: _ThreadID=693 _ThreadName=Thread-257] [levelValue: 800] [[
  251460488 [Thread-257] INFO ma.xxx.xxxx.server.restproxy.RemoteRestProxyFactory - searchAllCoordinates in service discovery for repository.upload]]

```

I have the following Grok expression, but the message isn't being filtered as expected:

```auto
\[%{TIMESTAMP_ISO8601:timestamp}\] \[%{DATA:glassfish_version}\] \[%{LOGLEVEL:loglevel}\] \[\] \[%{DATA:logger}\] \[tid: _ThreadID=%{NUMBER:thread_id} _ThreadName=%{DATA:thread_name}\] \[levelValue: %{NUMBER:level_value}\] \[\[\n(?<message>(?s).*?)\]\].

```

Thanks in advance

---

<div class="post-metadata">

### Author: ![strawgate](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/strawgate/32/131008_2.png) [@strawgate](https://discuss.elastic.co/u/strawgate)
#### Post date: [March 3, 2025, 2:23pm UTC](https://discuss.elastic.co/t/need-help-with-grok-expression-logstash/375313/2 "2025-03-03T14:23:03Z")

</div>

> [@Mohamed\_NOUISSEL](#):
>
> ```auto
> [2025-03-02T17:17:00.722133Z] [GF 7.0.12] [INFO] [] [jakarta.enterprise.logging.stdout] [tid: _ThreadID=693 _ThreadName=Thread-257] [levelValue: 800] [[
> 251460488 [Thread-257] INFO ma.xxx.xxxx.server.restproxy.RemoteRestProxyFactory - searchAllCoordinates in service discovery for repository.upload]]
> 
> ```

it doesn't like the `(?s)` you've added after `<message>`

This works just fine for me:  
`\[%{TIMESTAMP_ISO8601:timestamp}\] \[%{DATA:glassfish_version}\] \[%{LOGLEVEL:loglevel}\] \[\] \[%{DATA:logger}\] \[tid: _ThreadID=%{NUMBER:thread_id} _ThreadName=%{DATA:thread_name}\] \[levelValue: %{NUMBER:level_value}\] \[\[\n(?<message>.*?)\]\]`

---

<div class="post-metadata">

### Author: ![Mohamed\_NOUISSEL](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mohamed_nouissel/32/141755_2.png) [@Mohamed\_NOUISSEL](https://discuss.elastic.co/u/Mohamed_NOUISSEL)
#### Post date: [March 3, 2025, 3:06pm UTC](https://discuss.elastic.co/t/need-help-with-grok-expression-logstash/375313/3 "2025-03-03T15:06:23Z")

</div>

![grok logstash](https://us1.discourse-cdn.com/elastic/original/3X/8/2/82cd4029a572d90fbf5e2837b535afcd0e1eee32.png)  
Thanks, it doesn't work for me because there is a line break after [[

---

<div class="post-metadata">

### Author: ![Mohamed\_NOUISSEL](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mohamed_nouissel/32/141755_2.png) [@Mohamed\_NOUISSEL](https://discuss.elastic.co/u/Mohamed_NOUISSEL)
#### Post date: [March 3, 2025, 4:02pm UTC](https://discuss.elastic.co/t/need-help-with-grok-expression-logstash/375313/4 "2025-03-03T16:02:26Z")

</div>

Plz, i want grok pattern for my case

---

<div class="post-metadata">

### Author: ![strawgate](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/strawgate/32/131008_2.png) [@strawgate](https://discuss.elastic.co/u/strawgate)
#### Post date: [March 3, 2025, 5:54pm UTC](https://discuss.elastic.co/t/need-help-with-grok-expression-logstash/375313/5 "2025-03-03T17:54:51Z")

</div>

those aren't lines, those are different samples

different lines in a log would have a `\n` between them

If your pipeline is producing two events from the message because it's on two lines in the log file then you need to setup a multi-line reader to ensure that both lines end up in the message field of the log.

your grok pattern already has a `\n` in it to handle this