# Problem with grok and multiline pattern

**URL:** <https://discuss.elastic.co/t/problem-with-grok-and-multiline-pattern/103201>\
**Category:** Logstash\
**Created:** [October 9, 2017, 9:30am UTC](https://discuss.elastic.co/t/problem-with-grok-and-multiline-pattern/103201 "2017-10-09T09:30:53Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rodolphe\_Redoute](https://avatars.discourse-cdn.com/v4/letter/r/eb9ed0/32.png) [@Rodolphe\_Redoute](https://discuss.elastic.co/u/Rodolphe_Redoute)\
**Post date:** [October 9, 2017, 9:30am UTC](https://discuss.elastic.co/t/problem-with-grok-and-multiline-pattern/103201/1 "2017-10-09T09:30:53Z")

</div>

Hi, I have a touchy problem,

I need to make a filter for a log file but here is the thing :

inside this file there is some log with Multiline and the begining of theses lines is not the same than the "one line"  
here is exemple :

here are the 2 types of "one line" logs :

```
 [2017-10-05 16:24:55 +0200 SERVICE]: enabling watch folder: /data/server/incoming/dash_vod/

2017-10-05 14:38:38 F Pipeline cancelled while waiting for decoded picture.

```

and here is a multiline log :

```
[2017-10-05 16:38:39 +0200 SERVICE]: EME returned error:
 <response value="error">
  <error value="1999">
    <message>Video decoder: [Error in MPEG-2 GPU decode]</message>
  </error>
</response>

```

so here is my problem : I can't create a Multiline Pattern because, i tried to make my log line start with the date (2017-10-05 16:38:39) but when i do this, the lines which start with a "[" are stuck with the last line of this format, and when i try to make my log line start with the "[" same problem appear reciprocally

i tried both of theses multiline pattern :  
^([0-9]{4}-[0-9]{2}-[0-9]{2})  
^([[0-9]{4}-[0-9]{2}-[0-9]{2})

To be more precise i need a solution to manage theses two kind of line

i'm not sure i'm clear in my explanation, so if anyone has a clue to help me that would be great !

Thx for reading.

---

<div class="post-metadata">

**Author:** ![Rodolphe\_Redoute](https://avatars.discourse-cdn.com/v4/letter/r/eb9ed0/32.png) [@Rodolphe\_Redoute](https://discuss.elastic.co/u/Rodolphe_Redoute)\
**Post date:** [October 9, 2017, 10:02am UTC](https://discuss.elastic.co/t/problem-with-grok-and-multiline-pattern/103201/2 "2017-10-09T10:02:41Z")

</div>

okey i found a solution :

in my multiline pattern i used `^(expr1|expr2)` with both my expressions and it worked.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 6, 2017, 10:03am UTC](https://discuss.elastic.co/t/problem-with-grok-and-multiline-pattern/103201/3 "2017-11-06T10:03:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.