# Problem with logstash handling the mysql-slow.log
**URL:** https://discuss.elastic.co/t/problem-with-logstash-handling-the-mysql-slow-log/69531
**Category:** Logstash
**Created:** [December 20, 2016, 8:11am UTC](https://discuss.elastic.co/t/problem-with-logstash-handling-the-mysql-slow-log/69531 "2016-12-20T08:11:13Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@houfan](https://discuss.elastic.co/u/houfan)
#### Post date: [December 20, 2016, 8:11am UTC](https://discuss.elastic.co/t/problem-with-logstash-handling-the-mysql-slow-log/69531/1 "2016-12-20T08:11:13Z")
this is the filebeat.yml:
> ```
> filebeat:
> prospectors:
> -
> paths:
> - /usr/local/nginx/logs/mysql-slow.log
> input_type: log
> document_type: mysql-slow
> multiline:
> pattern: ^# User@Host
> negate: true
> match: after
>
> ```
and the mysql-slow.log is like this:
> # Time: 161214 1:31:38
>
> # User@Host: alltechremotecon[alltechremotecon] @ [121.201.7.19] Id: 4864505058
>
> # Schema: apppool Last\_errno: 0 Killed: 0
>
> # Query\_time: 5.001162 Lock\_time: 0.000171 Rows\_sent: 10000 Rows\_examined: 330000 Rows\_affected: 0
>
> # Bytes\_sent: 3172809
>
> SET timestamp=1481650298;
> # administrator command: Prepare;
>
> # User@Host: gcenter[gcenter] @ [192.168.168.100] Id: 4882345700
>
> # Schema: gcenter Last\_errno: 0 Killed: 0
>
> # Query\_time: 5.883876 Lock\_time: 0.000000 Rows\_sent: 0 Rows\_examined: 0 Rows\_affected: 0
>
> # Bytes\_sent: 435
>
> use gcenter;
> SET timestamp=1481691552;
> how to handle with these two different headings "# Time" "# administrator"?
I tried this way:
> if [message] =~ "^# administrator" {
> drop {}
> }
> if [message] =~ "^# Time:" {
> drop {}
> }
> but it didn't work as expect.so,I really appreciate if you could help .....😣
---
### Author:  [@guyboertje](https://discuss.elastic.co/u/guyboertje)
#### Post date: [December 20, 2016, 3:58pm UTC](https://discuss.elastic.co/t/problem-with-logstash-handling-the-mysql-slow-log/69531/2 "2016-12-20T15:58:51Z")
Why do you have the `#` character in the if conditional? `if [message] =~ "^# administrator" {`
Should it simply be `if [message] =~ "^\s*administrator" {`?
---
### Author:  [@guyboertje](https://discuss.elastic.co/u/guyboertje)
#### Post date: [December 20, 2016, 4:21pm UTC](https://discuss.elastic.co/t/problem-with-logstash-handling-the-mysql-slow-log/69531/3 "2016-12-20T16:21:26Z")
ok, my bad, it looks like the `#` character is in the data.
The answer is: you are using multiline, meaning that the message field starts with `# User@Host` - it will never start with `# administrator` or `# Time`
Magnus answered this here [How to drop a message](https://discuss.elastic.co/t/how-to-drop-a-message/69548/2?u=guyboertje)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 17, 2017, 4:21pm UTC](https://discuss.elastic.co/t/problem-with-logstash-handling-the-mysql-slow-log/69531/4 "2017-01-17T16:21:29Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.