# Question in Multi line grok pattern

**URL:** <https://discuss.elastic.co/t/question-in-multi-line-grok-pattern/76632>\
**Category:** Logstash\
**Created:** [February 27, 2017, 2:06pm UTC](https://discuss.elastic.co/t/question-in-multi-line-grok-pattern/76632 "2017-02-27T14:06:44Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mohsen\_Sabbaghi](https://avatars.discourse-cdn.com/v4/letter/m/9fc29f/32.png) [@Mohsen\_Sabbaghi](https://discuss.elastic.co/u/Mohsen_Sabbaghi)\
**Post date:** [February 27, 2017, 2:06pm UTC](https://discuss.elastic.co/t/question-in-multi-line-grok-pattern/76632/1 "2017-02-27T14:06:44Z")

</div>

hi there

this is my #beats:filebeat config file that read and send logs to output #logstash:

```
filebeat.prospectors:
    - input_type: log

      paths:
        - D:\log\my-log01.log

      tags: ["log01"]

      fields:
        log-01: true

    #================================
    - input_type: log

      paths:
        - D:\log\my-log02.log

      tags: ["log02"] # ***tags***

      fields:
        log-02: true # ***field****

```

and... some more files like this....

here is my #logstash config file that sets `(path.config: ..\config\my-pipeline.conf)` to read from my-pipeline:

my-pipeline:

```
input {
  beats {
		type => "log"
		port => 5044
    }
}

filter {
	if [log-01] == "true" { # ***conditional statement***
		grok {
			patterns_dir => "./patterns"
			break_on_match => false
			match => [
						"message" , "%{LOGINFO} -> %{NUMBERMSGID}->*%{DATA:action}->MpcRequest{id=%{DATA:ReqID}, appId=%{INT:appID}, appInfo=%{QS:appInfo}, opCode=%{DATA:OpCode}, sessionId=%{DATA:SessionID}, mobileNo='%{INT:MobileNo}', messageBody=%{QS:MessageBody}, opCode=%{DATA:OpCode}, ctm=%{DATA:CTM}, udh=%{DATA:UDH}, keyword=%{DATA:keyword}, messageId=%{DATA:MessageID}, host.IP=Host{id=%{DATA:ID}, ip='%{IP:ip}'}, httpHeader.RemoteAddr=Header{id=%{DATA:HeaderID}, remoteAddr='%{IP:RemoteIP}:%{INT:Port}', xForwardedFor='%{DATA:xForwardedFor}'}, smsProviderSmsProvider{id=%{DATA:SMSProviderID}, userName=%{DATA:UserName}, smsNumber=%{DATA:SMSNumber}}}, messageBody=%{GREEDYDATA:MessageBody}}",
						"message" , "%{LOGINFO} -> %{NUMBERMSGID}->=%{WORD:health}=%{DATA:action}==>RSResponse{tranId= %{DATA:TeranID}, status=(?<Status>\w+\(\d+\)), opCode=(?<OP-Code>\w+\(\d+\)), securityStatus=%{NUMBER:securityStatus}, description=%{QUOTEDSTRING:description}, serverTime=%{QS}, advertise=%{DATA:advertise}, extraData=%{GREEDYDATA:ExteraData}}",
						"message" , "%{LOGINFO} -> %{NUMBERMSGID}->%{DATA:action}->(?<Length>\(\w+:\d+\)): %{GREEDYDATA:msg}",
						"message" , "%{LOGINFO} -> %{NUMBERMSGID}->%{GREEDYDATA:msg}",
						"message" , "%{LOGINFO} -> %{GREEDYDATA:msg}"
					  ]
			tag_on_failure => ["log01-Failure"]
		}
	}
	if [log-02] == "true" {
		grok {
			patterns_dir => "./patterns"
			break_on_match => false
			match => [
						"message" , "%{LOGINFO} -> %{NUMBERMSGID}->*%{DATA:action}->MpcRequest{id=%{DATA:ReqID}, appId=%{INT:appID}, appInfo=%{QS:appInfo}, opCode=%{DATA:OpCode}, sessionId=%{DATA:SessionID}, mobileNo='%{INT:MobileNo}', messageBody=%{QS:MessageBody}, opCode=%{DATA:OpCode}, ctm=%{DATA:CTM}, udh=%{DATA:UDH}, keyword=%{DATA:keyword}, messageId=%{DATA:MessageID}, host.IP=Host{id=%{DATA:ID}, ip='%{IP:ip}'}, httpHeader.RemoteAddr=Header{id=%{DATA:HeaderID}, remoteAddr='%{IP:RemoteIP}:%{INT:Port}', xForwardedFor='%{DATA:xForwardedFor}'}, smsProviderSmsProvider{id=%{DATA:SMSProviderID}, userName=%{DATA:UserName}, smsNumber=%{DATA:SMSNumber}}}, messageBody=%{GREEDYDATA:MessageBody}}",
						"message" , "%{LOGINFO} -> %{NUMBERMSGID}->=%{WORD:health}=%{DATA:action}==>RSResponse{tranId= %{DATA:TeranID}, status=(?<Status>\w+\(\d+\)), opCode=(?<OP-Code>\w+\(\d+\)), securityStatus=%{NUMBER:securityStatus}, description=%{QUOTEDSTRING:description}, serverTime=%{QS}, advertise=%{DATA:advertise}, extraData=%{GREEDYDATA:ExteraData}}",
						"message" , "%{LOGINFO} -> %{NUMBERMSGID}->%{DATA:action}->(?<Length>\(\w+:\d+\)): %{GREEDYDATA:msg}",
						"message" , "%{LOGINFO} -> %{NUMBERMSGID}->%{GREEDYDATA:msg}",
						"message" , "%{LOGINFO} -> %{GREEDYDATA:msg}"
					  ]
			tag_on_failure => ["log02-Failure"]
		}
	}
}

output {
	stdout{
		codec => rubydebug
	}
elasticsearch {
    hosts => ["localhost:9200"]
}     
}

```

and there is also some custom pattern that i makes them using RegEX in .`/pattern` folder.🕶

- there is no problem in stashing the logs without conditional statement.

Questions 😊

1. did i correctly use of different multiline grok patterns for different log files ?
2. how can i check the tag names (mention by `# ***tags*** ` in code) or field names (mention by `# ***field*** ` in code) that i defined in #beats:filebeat config file at conditional statement (mentiond by`# ***conditional statement*** `) ?

---

<div class="post-metadata">

**Author:** ![Mohsen\_Sabbaghi](https://avatars.discourse-cdn.com/v4/letter/m/9fc29f/32.png) [@Mohsen\_Sabbaghi](https://discuss.elastic.co/u/Mohsen_Sabbaghi)\
**Post date:** [February 28, 2017, 1:25pm UTC](https://discuss.elastic.co/t/question-in-multi-line-grok-pattern/76632/2 "2017-02-28T13:25:55Z")

</div>

@magnusbaeck need your help bro

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 28, 2017, 1:26pm UTC](https://discuss.elastic.co/t/question-in-multi-line-grok-pattern/76632/3 "2017-03-28T13:26:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.