# Remove a line block according to a certain string value

**URL:** <https://discuss.elastic.co/t/remove-a-line-block-according-to-a-certain-string-value/106210>\
**Category:** Logstash\
**Created:** [November 2, 2017, 2:53pm UTC](https://discuss.elastic.co/t/remove-a-line-block-according-to-a-certain-string-value/106210 "2017-11-02T14:53:43Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![cy8el1us](https://avatars.discourse-cdn.com/v4/letter/c/e9bcb4/32.png) [@cy8el1us](https://discuss.elastic.co/u/cy8el1us)\
**Post date:** [November 2, 2017, 2:53pm UTC](https://discuss.elastic.co/t/remove-a-line-block-according-to-a-certain-string-value/106210/1 "2017-11-02T14:53:43Z")

</div>

I am new with ELK and I am trying to skip/remove a line block according to a certain string value from a grok tag.

```
2015-05-21 18:53:20,560 -3- [Class] A certain string
2015-05-21 18:53:20,560 -3- [Class] Col1 Col2 Col3 Col4 Col5 Col6 Col7 Col8 Col9 Col10 Col11 Class
2015-05-21 18:53:20,560 -3- [Class] 0 0 96 0 0 234 21351 0 64 473 6172 com.class1
2015-05-21 18:53:20,560 -3- [Class] 0 0 5467 0 0 0 1 0 0 4 226 com.class2
2015-05-21 18:53:20,560 -3- [Class] 0 0 36 0 0 0 0 65 428 7727 15435 com.class3
2015-05-21 18:53:20,560 -3- [Class] 0 0 377841 0 0 0 4 0 0 1 402 com.class4
2015-05-21 18:53:20,560 -3- [Class] 0 0 33 0 0 0 1 0 1 6 52 com.class5
2015-05-21 18:53:20,560 -3- [Class] 0 0 796 0 0 0 1 0 2 24 1662 com.class6
2015-05-21 18:53:20,560 -3- [Class] 0 0 531205 0 0 0 4 0 0 102 23115 com.class7
2015-05-21 18:53:20,560 -3- [Class] 0 0 75534 0 0 0 1 0 0 21 246 com.class2
2015-05-21 18:53:20,560 -3- [Class] 0 0 12413 0 0 0 1 0 6 1822 85529 com.class1
2015-05-21 18:53:20,560 -3- [Class] Another String
2015-05-21 18:53:20,560 -3- [Class] Col1 Col2 Col3 Col4 Col5 Col6 Col7 Col8 Col9 Col10 Col11 Class
2015-05-21 18:53:20,560 -3- [Class] 0 0 96 0 0 234 21351 0 64 473 6172 com.class1
2015-05-21 18:53:20,560 -3- [Class] 0 0 5467 0 0 0 1 0 0 4 226 com.class2
2015-05-21 18:53:20,560 -3- [Class] 0 0 796 0 0 0 1 0 2 24 1662 com.class6
2015-05-21 18:53:20,560 -3- [Class] 0 0 531205 0 0 0 4 0 0 102 23115 com.class7
2015-05-21 18:53:20,560 -3- [Class] 0 0 75534 0 0 0 1 0 0 21 246 com.class2
2015-05-21 18:53:20,560 -3- [Class] 0 0 12413 0 0 0 1 0 6 1822 85529 com.class1

```

this example show you the issue which I am facing to. The first line contain "A certain string" and I need to remove all lines after this line until logstash meet the line 12 where "A certain string" is changing in "Another String". Is it possible to do this? Thx

---

<div class="post-metadata">

**Author:** ![Ryanbarnes](https://avatars.discourse-cdn.com/v4/letter/r/f0a364/32.png) [@Ryanbarnes](https://discuss.elastic.co/u/Ryanbarnes)\
**Post date:** [November 2, 2017, 8:58pm UTC](https://discuss.elastic.co/t/remove-a-line-block-according-to-a-certain-string-value/106210/2 "2017-11-02T20:58:21Z")

</div>

After using grok to match the lines with the string you want to keep, tag them using add\_tag . Below your grok, write an if statement, checking if the line has been tagged and dropping everything else that isn't.

> if "taggedLine" not in [tags] {  
> drop {}  
> }

> **[Grok filter plugin | Logstash Reference \[8.11\] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html#plugins-filters-grok-add_tag)**

---

<div class="post-metadata">

**Author:** ![cy8el1us](https://avatars.discourse-cdn.com/v4/letter/c/e9bcb4/32.png) [@cy8el1us](https://discuss.elastic.co/u/cy8el1us)\
**Post date:** [November 6, 2017, 8:02am UTC](https://discuss.elastic.co/t/remove-a-line-block-according-to-a-certain-string-value/106210/3 "2017-11-06T08:02:24Z")

</div>

Hello Ryan. Thank you for your help. I tried it before but I cannot differentiate lines between:  
2015-05-21 18:53:20,560 -3- [Class] A certain string

and after:  
2015-05-21 18:53:20,560 -3- [Class] Another String

I just want to keep lines after " 2015-05-21 18:53:20,560 -3- [Class] Another String " and drop lines before it. That's why it is a little bit more complicate I think

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 4, 2017, 8:02am UTC](https://discuss.elastic.co/t/remove-a-line-block-according-to-a-certain-string-value/106210/4 "2017-12-04T08:02:28Z")

</div>

Closed on December 4, 2017, 8:02am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.