# Specific GROK filter for multi-line Postgresql log

**URL:** <https://discuss.elastic.co/t/specific-grok-filter-for-multi-line-postgresql-log/56286>\
**Category:** Logstash\
**Created:** [July 25, 2016, 10:59am UTC](https://discuss.elastic.co/t/specific-grok-filter-for-multi-line-postgresql-log/56286 "2016-07-25T10:59:42Z")\
**Posts on this page:** 1\
**Showing post:** 8

<div class="post-metadata">

**Author:** ![111126](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/111126/32/36818_2.png) [@111126](https://discuss.elastic.co/u/111126)\
**Post date:** [August 11, 2016, 5:56am UTC](https://discuss.elastic.co/t/specific-grok-filter-for-multi-line-postgresql-log/56286/8 "2016-08-11T05:56:11Z")

</div>

I expect the next:

> event 1: ...[137-1] and [137-2]...  
> event 2: ...[2953-1]...  
> event 3: ...[3779-1]...  
> event 4: ...[138-1] and [138-2]...  
> event 5: ...[3780-1]...  
> event 6: ...[139-1]...  
> event 7: ...[2954-1] and [2954-2]...

Task\_id in this case may be [24977] or 137.

My friend help me with ruby code and I made such a configuration:

> filter {  
> grok {  
> match =\> ["message", "%{SYSLOGTIMESTAMP:timestamp} %{SYSLOGHOST:logsource} %{SYSLOGPROG}: [%{INT:line}-%{INT:part\_of\_line}] %{GREEDYDATA:ostatok}" ]  
> }

> ```
> aggregate {
> task_id => "%{line}"
> code => "map['full_message'] ||= '' ; map['full_message'] += event['ostatok'] ; event['full_message'] ||= '' ; event['full_message'] = map['full_message']"
> }
> 
> ```
> 
> }  
> But I have next event on elasticsearch:

> event 1: ...[137-1]...  
> event 2: ...[137-1] and [137-2]...  
> event 3: ...[2953-1]...  
> event 4: ...[3779-1]...  
> event 5: ...[138-1]...  
> event 6: ...[138-1] and [138-2]...  
> event 7: ...[3780-1]...  
> event 8: ...[139-1]...  
> event 9: ...[2954-1]...  
> event 10: ...[2954-1] and [2954-2]...  
> How I can clean my events from event 1: ...[137-1]..., event 5: ...[138-1]..., event 7: ...[2954-1]... ?

---

_[View the full topic](https://discuss.elastic.co/t/specific-grok-filter-for-multi-line-postgresql-log/56286)._