# Picked up from multi-line logs using grok pattern
**URL:** https://discuss.elastic.co/t/picked-up-from-multi-line-logs-using-grok-pattern/206365
**Category:** Logstash
**Created:** [November 4, 2019, 10:19am UTC](https://discuss.elastic.co/t/picked-up-from-multi-line-logs-using-grok-pattern/206365 "2019-11-04T10:19:10Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@kavindu\_manaram](https://discuss.elastic.co/u/kavindu_manaram)
#### Post date: [November 4, 2019, 10:19am UTC](https://discuss.elastic.co/t/picked-up-from-multi-line-logs-using-grok-pattern/206365/1 "2019-11-04T10:19:10Z")
Here is my one log segment which file beat picked.
2019-10-23 09:53:43.2218 - [yyy] [EF] Opened connection at 10/23/2019 9:53:43 AM +05:30
2019-10-23 09:53:43.2218 - [yyy] [EF]
\***_SELECT Count(_)**
**FROM INFORMATION\_SCHEMA**
2019-10-23 09:53:43.2218 - [yyy] [EF]
2019-10-23 09:53:43.2257 - [yyy] [EF] -- Executing at 10/23/2019 9:53:43 AM +05:30
2019-10-23 09:53:43.3504 - [yyy] [EF] -- Completed in _ **123** _ ms with result: 60
2019-10-23 09:53:43.3504 - [yyy] [EF]
2019-10-23 09:53:43.3504 - [yyy] [EF] Closed connection at 10/23/2019 9:53:43 AM +05:30
it piked from "[timestamp] [x] [y] Open Connection" to next "[timestamp] [y] Open Connection"
I want to extract the above bold lines(sql query and completed time in ms ) using grok pattern in logstash. is it possible to do?
This this the way I'm try to do this. But it is not valied
`(?m)%{TIMESTAMP_ISO8601:timestamp} - \[%{NOTSPACE:orgCode}\] \[%{NOTSPACE:framework}\] %{GREEDYDATA:startingMessage}%{TIMESTAMP_ISO8601} - \[%{NOTSPACE}\] \[%{NOTSPACE}\] %{GREEDYDATA:message} %{TIMESTAMP_ISO8601}`
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 2, 2019, 10:19am UTC](https://discuss.elastic.co/t/picked-up-from-multi-line-logs-using-grok-pattern/206365/2 "2019-12-02T10:19:12Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.