# Subsequently get only first line of multi-line grok
**URL:** https://discuss.elastic.co/t/subsequently-get-only-first-line-of-multi-line-grok/33381
**Category:** Logstash
**Created:** [October 30, 2015, 2:40pm UTC](https://discuss.elastic.co/t/subsequently-get-only-first-line-of-multi-line-grok/33381 "2015-10-30T14:40:26Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@RobT](https://discuss.elastic.co/u/RobT)
#### Post date: [October 30, 2015, 2:40pm UTC](https://discuss.elastic.co/t/subsequently-get-only-first-line-of-multi-line-grok/33381/1 "2015-10-30T14:40:26Z")
So, I'm retrieving a multi-line input just fine and storing in message. However, for throttling purposes I'd like to also just consider the first line so I'm trying to break the multi-line message up. I'm trying this:
```
grok {
match => ["message", "(?m)%{TIMESTAMP_ISO8601:timestamp} \[%{NUMBER:threadId}\] %{LOGLEVEL:level} %{DATA:logger} %{GREEDYDATA:message}" ]
overwrite => ["message"]
tag_on_failure => ["error_message_not_parsed"]
break_on_match => false
}
```
...
```
# create a copy of the message
mutate {
add_field => { "message_array" => "%{message}" }
}
# make new copy become an array whereby each line is an element
mutate {
split => { "message_array" => "\n" }
}
# keep first line only
mutate {
replace => { "message_array" => "%{[message_array][0]}" }
}
# let's throttle events after first occurrence each 5 minutes for email purposes
throttle {
before_count => -1
after_count => 1
period => 300
key => "%{city}%{message_array}"
add_tag => "throttled"
}
```
message\_array is still the same as message however ( not just the first line ), so appears I'm doing something wrong with the split?
---
### Author:  [@RobT](https://discuss.elastic.co/u/RobT)
#### Post date: [October 30, 2015, 7:11pm UTC](https://discuss.elastic.co/t/subsequently-get-only-first-line-of-multi-line-grok/33381/2 "2015-10-30T19:11:29Z")
It was the mutate split on "\n" that does not work - worked around using:
```
ruby {
code => "event['message_array'] = event['message_array'].split(/\n/)"
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:24am UTC](https://discuss.elastic.co/t/subsequently-get-only-first-line-of-multi-line-grok/33381/3 "2017-07-06T05:24:48Z")