# Parsing Error Logs with line breaks

**URL:** <https://discuss.elastic.co/t/parsing-error-logs-with-line-breaks/240419>\
**Category:** Logstash\
**Created:** [July 8, 2020, 6:27pm UTC](https://discuss.elastic.co/t/parsing-error-logs-with-line-breaks/240419 "2020-07-08T18:27:03Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![milkene](https://avatars.discourse-cdn.com/v4/letter/m/9fc29f/32.png) [@milkene](https://discuss.elastic.co/u/milkene)\
**Post date:** [July 8, 2020, 6:27pm UTC](https://discuss.elastic.co/t/parsing-error-logs-with-line-breaks/240419/1 "2020-07-08T18:27:03Z")

</div>

Hi, I am trying to parse logs with Logstash using Grok filters. Most of the logs are a single line but some have line breaks and spaces between them. Is there a way to get Logstash to recognize them as one log rather than ending the message at the line break? Thanks

---

<div class="post-metadata">

**Author:** ![grumo35](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/grumo35/32/59451_2.png) [@grumo35](https://discuss.elastic.co/u/grumo35)\
**Post date:** [July 8, 2020, 7:49pm UTC](https://discuss.elastic.co/t/parsing-error-logs-with-line-breaks/240419/2 "2020-07-08T19:49:27Z")

</div>

You might want to look into why your logs are not clean lines, maybe loggrotate ? or the way you ship your logs ?

Anyway, you could look into something like checking the "\_grokparsefailure" in [tags] which whill sort out the bad looking logs.  
Then you could use [logstash mutate plugin](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html)  
with "strip" you could remove "\n" and look for how whitespaces with "gsub" but the impact on the log itself is hard to tell without any samples.

Can you provide some log samples and how you ship your logs to better understand ?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 5, 2020, 7:49pm UTC](https://discuss.elastic.co/t/parsing-error-logs-with-line-breaks/240419/3 "2020-08-05T19:49:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.