# Read different lines of single log file having different pattern

**URL:** <https://discuss.elastic.co/t/read-different-lines-of-single-log-file-having-different-pattern/89536>\
**Category:** Logstash\
**Created:** [June 15, 2017, 9:52am UTC](https://discuss.elastic.co/t/read-different-lines-of-single-log-file-having-different-pattern/89536 "2017-06-15T09:52:44Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![richagautam](https://avatars.discourse-cdn.com/v4/letter/r/9e8a1a/32.png) [@richagautam](https://discuss.elastic.co/u/richagautam)\
**Post date:** [June 15, 2017, 9:52am UTC](https://discuss.elastic.co/t/read-different-lines-of-single-log-file-having-different-pattern/89536/1 "2017-06-15T09:52:45Z")

</div>

Hi ,

2/17/2017 16:11:14 hostname some text some text  
2/17/2017 16:11:14 hostname Filename !!Begin test: Scriptname: abcTest/output/outputfile.log  
2/17/2017 16:11:14 hostname Filename test data test data test data test data  
2/17/2017 16:11:14 hostname \>\> test data test data  
2/17/2017 16:11:14 hostname \>\> exception after this line1  
2/17/2017 16:11:14 hostname \<\< exception after this line2  
2/17/2017 16:11:14 hostname \<\< exception after this line3  
2/17/2017 16:11:14 hostname Filename not found exception  
2/17/2017 16:11:14 hostname Filename test data test data test data test data  
2/17/2017 16:11:14 hostname Filename test data test data test data test data  
2/17/2017 16:11:14 hostname testing test data test dat  
2/17/2017 16:11:14 hostname Knowledge Base:data  
2/17/2017 16:11:14 hostname FAIL: Testcase completed :setup() has failed  
2/17/2017 16:11:14 hostname Filename test data test data test data test data

I have to parse these kinds of log files.This is a single log file.  
In this log i have to read three different line.

1.2/17/2017 16:11:14 hostname Filename !!Begin test: Scriptname: abcTest/output/outputfile.log

```
to extract text after Filename !!Begin test:

```

1. 2/17/2017 16:11:14 hostname Knowledge Base:data  
2/17/2017 16:11:14 hostname FAIL: Testcase completed :setup() has failed

read these lines as a single line and then check some condition and then extract text after FAIL: Testcase completed :setup() has failed

1. 

2/17/2017 16:11:14 hostname \<\< exception after this line  
2/17/2017 16:11:14 hostname Filename not fount exception

check if "\<\< " is the last occurence of then read next line.

I have to save this data in a csv file to i am planning to use

file{  
codec =\> line{ format =\> "%{field1},{field2}"}  
path =\> "output.csv"  
}

Please advice how should i proceed for this.-

1. should i use multiple grok and in each grok i read different pattern then in output i take the required fields only.

2. Can I merge the whole file in a single line then read the read the required text.  
because i want to read different lines of single file having different pattern and then output in a single row

Please advice this urgent.

Thanks

---

<div class="post-metadata">

**Author:** ![richagautam](https://avatars.discourse-cdn.com/v4/letter/r/9e8a1a/32.png) [@richagautam](https://discuss.elastic.co/u/richagautam)\
**Post date:** [June 16, 2017, 5:18am UTC](https://discuss.elastic.co/t/read-different-lines-of-single-log-file-having-different-pattern/89536/2 "2017-06-16T05:18:32Z")

</div>

Hi,

Please advice.

Thanks

---

<div class="post-metadata">

**Author:** ![richagautam](https://avatars.discourse-cdn.com/v4/letter/r/9e8a1a/32.png) [@richagautam](https://discuss.elastic.co/u/richagautam)\
**Post date:** [June 23, 2017, 9:28am UTC](https://discuss.elastic.co/t/read-different-lines-of-single-log-file-having-different-pattern/89536/3 "2017-06-23T09:28:54Z")

</div>

Hi,

I am able to extract multiple pattern .

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 21, 2017, 9:34am UTC](https://discuss.elastic.co/t/read-different-lines-of-single-log-file-having-different-pattern/89536/4 "2017-07-21T09:34:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.