# Parsing multiline logs in Logstash

**URL:** <https://discuss.elastic.co/t/parsing-multiline-logs-in-logstash/89676>\
**Category:** Logstash\
**Created:** [June 16, 2017, 8:57am UTC](https://discuss.elastic.co/t/parsing-multiline-logs-in-logstash/89676 "2017-06-16T08:57:36Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![nmane](https://avatars.discourse-cdn.com/v4/letter/n/a9adbd/32.png) [@nmane](https://discuss.elastic.co/u/nmane)\
**Post date:** [June 16, 2017, 8:57am UTC](https://discuss.elastic.co/t/parsing-multiline-logs-in-logstash/89676/1 "2017-06-16T08:57:36Z")

</div>

I am using Logstash to parse my multiline logs. I have used multiline in filebeat. I am able to use grok filter for the first line of the log. But the pattern is not same for all multiline logs. For example, my logs are:

> [timestamp] [bla] [bla] [[  
> A  
> at bla  
> at bla  
> B  
> C  
> at bla  
> ]]

I want information given by A, B ,C. Position of A, B, C in the logs is not always same. Also, there are few logs in which A, B, C do not exist. Can I use grok pattern or anything to create fields from A, B, C? If yes, then how?

---

<div class="post-metadata">

**Author:** ![Adam\_Szabo](https://avatars.discourse-cdn.com/v4/letter/a/67e7ee/32.png) [@Adam\_Szabo](https://discuss.elastic.co/u/Adam_Szabo)\
**Post date:** [June 16, 2017, 11:42am UTC](https://discuss.elastic.co/t/parsing-multiline-logs-in-logstash/89676/2 "2017-06-16T11:42:14Z")

</div>

Maybe it's the aggregate plugin which you're looking for?  
[https://www.elastic.co/guide/en/logstash/current/plugins-filters-aggregate.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-aggregate.html)

---

<div class="post-metadata">

**Author:** ![Kryten](https://avatars.discourse-cdn.com/v4/letter/k/58956e/32.png) [@Kryten](https://discuss.elastic.co/u/Kryten)\
**Post date:** [June 17, 2017, 9:33pm UTC](https://discuss.elastic.co/t/parsing-multiline-logs-in-logstash/89676/3 "2017-06-17T21:33:22Z")

</div>

Can you configure FB or LS multiline to treat any line which does not begin with a timestamp to be multiline and fold it into the previous line.

That should get you the whole thing in one blob.

You could then test to see if A is in there and if so grok it. Repeat for B. Reapeat for C.

---

<div class="post-metadata">

**Author:** ![nmane](https://avatars.discourse-cdn.com/v4/letter/n/a9adbd/32.png) [@nmane](https://discuss.elastic.co/u/nmane)\
**Post date:** [June 22, 2017, 12:22pm UTC](https://discuss.elastic.co/t/parsing-multiline-logs-in-logstash/89676/4 "2017-06-22T12:22:31Z")

</div>

I know about multiline pattern. And Logstash will consider it as a single log. But the position of A, B, C is not fixed. Here is my problem. How will I know here is A and I will use conditions accordingly?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 20, 2017, 12:22pm UTC](https://discuss.elastic.co/t/parsing-multiline-logs-in-logstash/89676/5 "2017-07-20T12:22:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.