# Parsing a multiline log **URL:** \ **Category:** Logstash\ **Created:** [February 28, 2016, 9:05am UTC](https://discuss.elastic.co/t/parsing-a-multiline-log/42936 "2016-02-28T09:05:35Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![lucifer](https://avatars.discourse-cdn.com/v4/letter/l/ad7895/32.png) [@lucifer](https://discuss.elastic.co/u/lucifer)\ **Post date:** [February 28, 2016, 9:05am UTC](https://discuss.elastic.co/t/parsing-a-multiline-log/42936/1 "2016-02-28T09:05:35Z")
How can I parse some information present in the last line of a multiline message. For example, the log format is: the first line contains the timestamp, the log level and some other important information, which is followed by a multiline stack-trace, and within that stack trace is a specific pattern. I want to extract that pattern. How can I do it? I have used the multiline codec, but it just combines the log to one message, but the parsing of patterns happen only in the first line of the log. Can someone please help me? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [February 28, 2016, 11:12am UTC](https://discuss.elastic.co/t/parsing-a-multiline-log/42936/2 "2016-02-28T11:12:58Z")
You may have to put `(?m)` at the beginning of the pattern. If you show an example input line and your current configuration it'll be less work to figure out what's wrong and it's more likely that someone will help you. ---
**Author:** ![lucifer](https://avatars.discourse-cdn.com/v4/letter/l/ad7895/32.png) [@lucifer](https://discuss.elastic.co/u/lucifer)\ **Post date:** [February 28, 2016, 1:30pm UTC](https://discuss.elastic.co/t/parsing-a-multiline-log/42936/3 "2016-02-28T13:30:05Z")
For example: log: 12 feb 2016 ......(something) (line 1) (line 2) (line 3) line 4 ........... ID: 123abd(a long string with no spaces) (line 5) Now after applying the multiline codec, if my pattern is "%{Timestamp} %{GREEDYDATA} (?ID:[\S]+)" it fails. How do i do it? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [February 28, 2016, 2:36pm UTC](https://discuss.elastic.co/t/parsing-a-multiline-log/42936/4 "2016-02-28T14:36:57Z")
Please provide your current configuration as requested earlier. > (?ID:[\S]+)" According to this pattern there can't be any spaces after "ID:" but in your example line there is a space. ---
**Author:** ![lucifer](https://avatars.discourse-cdn.com/v4/letter/l/ad7895/32.png) [@lucifer](https://discuss.elastic.co/u/lucifer)\ **Post date:** [February 28, 2016, 3:57pm UTC](https://discuss.elastic.co/t/parsing-a-multiline-log/42936/5 "2016-02-28T15:57:38Z")
> [@magnusbaeck](#): > > "(?ID: [\S]+)" If this is the pattern, then? It still shows "\_grokparsefailure" !!! ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [February 28, 2016, 4:28pm UTC](https://discuss.elastic.co/t/parsing-a-multiline-log/42936/6 "2016-02-28T16:28:19Z")
For the third time, please provide your current configuration. ---
**Author:** ![lucifer](https://avatars.discourse-cdn.com/v4/letter/l/ad7895/32.png) [@lucifer](https://discuss.elastic.co/u/lucifer)\ **Post date:** [February 29, 2016, 4:37am UTC](https://discuss.elastic.co/t/parsing-a-multiline-log/42936/7 "2016-02-29T04:37:53Z")
The configuration file? Like this is my input{ file { path =\> "/home/.\*.com" type =\> "framework" codec =\> multiline { pattern =\> "(?(?:Mon(?:day)?|Tue(?:sday)?|Wed(?:nesday)?|Thu(?:rsday)?|Fri(?:day)?|Sat(?:urday)?|Sun(?:day)?) %{MONTH} (?:(?:0[1-9])|(?:[12][0-9])|(?:3[01])|[1-9]) %{HOUR}:%{MINUTE}:%{SECOND} %{YEAR})" negate =\> true what =\> "previous" } } and this is my filter: grok{ match =\> ["message" , "(?(?:Mon(?:day)?|Tue(?:sday)?|Wed(?:nesday)?|Thu(?:rsday)?|Fri(?:day)?|Sat(?:urday)?|Sun(?:day)?) %{MONTH} (?:(?:0[1-9])|(?:[12][0-9])|(?:3[01])|[1-9]) %{HOUR}:%{MINUTE}:%{SECOND} %{YEAR}) %{GREEDYDATA} (ID=:)(?[0-9]{2,3}.[0-9]{2,3}.[0-9]{2,3}.[0-9]{2,3}([0-9]{1}))" ] } The timestamp format is okay. Like it is parsed according to the format I have. My question is how to I fetch the "ID" present in any line other than the first line? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [February 29, 2016, 6:45am UTC](https://discuss.elastic.co/t/parsing-a-multiline-log/42936/8 "2016-02-29T06:45:45Z")
> The configuration file? Yes! The configuration you just posted doesn't match the example your posted earlier and I'm all out of patience. Good luck. ---
**Author:** ![lucifer](https://avatars.discourse-cdn.com/v4/letter/l/ad7895/32.png) [@lucifer](https://discuss.elastic.co/u/lucifer)\ **Post date:** [February 29, 2016, 7:13am UTC](https://discuss.elastic.co/t/parsing-a-multiline-log/42936/9 "2016-02-29T07:13:11Z")
This is an actual log: Thu Feb 25 15:00:03 2016 nbdnclmlmc;lm [INFO] kjnclkklmc nckdnlmvl; nkcjlkmcp; nmdmc;c; RID=:10.88.81.211(0) jhcbdkjnclkasdncl Okay, for the last time. Please help me out. ---
**Author:** ![lucifer](https://avatars.discourse-cdn.com/v4/letter/l/ad7895/32.png) [@lucifer](https://discuss.elastic.co/u/lucifer)\ **Post date:** [February 29, 2016, 8:30am UTC](https://discuss.elastic.co/t/parsing-a-multiline-log/42936/10 "2016-02-29T08:30:37Z")
Please help me out. ---
**Author:** ![pecwich](https://avatars.discourse-cdn.com/v4/letter/p/bc79bd/32.png) [@pecwich](https://discuss.elastic.co/u/pecwich)\ **Post date:** [March 1, 2016, 4:59am UTC](https://discuss.elastic.co/t/parsing-a-multiline-log/42936/11 "2016-03-01T04:59:39Z")
It's actually a very good question. I am stuck on it too. What's the way out? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:09am UTC](https://discuss.elastic.co/t/parsing-a-multiline-log/42936/12 "2017-07-06T05:09:13Z")