# Parse out Two Fields from Multiline data in Logstash coming from Filebetes

**URL:** https://discuss.elastic.co/t/parse-out-two-fields-from-multiline-data-in-logstash-coming-from-filebetes/95055
**Category:** Logstash
**Created:** [July 30, 2017, 1:29am UTC](https://discuss.elastic.co/t/parse-out-two-fields-from-multiline-data-in-logstash-coming-from-filebetes/95055 "2017-07-30T01:29:38Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![vinaymishra](https://avatars.discourse-cdn.com/v4/letter/v/bc8723/32.png) [@vinaymishra](https://discuss.elastic.co/u/vinaymishra)
#### Post date: [July 30, 2017, 1:29am UTC](https://discuss.elastic.co/t/parse-out-two-fields-from-multiline-data-in-logstash-coming-from-filebetes/95055/1 "2017-07-30T01:29:38Z")

</div>

I have huge message chunk's coming out from filebetes . each message chunk has multiple below messages

OUTPUT\>  
OUTPUT\>===============================================  
OUTPUT\> HiveFilterPDO\_ExternalSource  
OUTPUT\> Tests run: 1, Failures: 0, Skips: 0  
OUTPUT\>===============================================  
OUTPUT\>

I need to parse out suppose " HiveFilterPDO\_ExternalSource" as testcase name and "Tests run: 1, Failures: 0, Skips: 0" as new field Passed \failed of the failure is 0\1 in the text.

I am new to grok filters and not sure how to do so. can some body help me on this.

Thanks in Advance.  
Vinay

---

<div class="post-metadata">

### Author: ![vinaymishra](https://avatars.discourse-cdn.com/v4/letter/v/bc8723/32.png) [@vinaymishra](https://discuss.elastic.co/u/vinaymishra)
#### Post date: [July 31, 2017, 4:05am UTC](https://discuss.elastic.co/t/parse-out-two-fields-from-multiline-data-in-logstash-coming-from-filebetes/95055/2 "2017-07-31T04:05:48Z")

</div>

I got the reply and the below are the grok that I used:  
OUTPUT\>=\*\nOUTPUT\>\s%{DATA:testcasedata}\n

Failure Case:  
\sTests\srun:\s\d\*,\s%{DATA:failuredata},\sSkips:\s\d\*\n

Thanks  
Vinay

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 28, 2017, 4:06am UTC](https://discuss.elastic.co/t/parse-out-two-fields-from-multiline-data-in-logstash-coming-from-filebetes/95055/3 "2017-08-28T04:06:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.