# Unable to Saperate Logs from Message Field

**URL:** <https://discuss.elastic.co/t/unable-to-saperate-logs-from-message-field/118176>\
**Category:** Logstash\
**Created:** [February 2, 2018, 7:37am UTC](https://discuss.elastic.co/t/unable-to-saperate-logs-from-message-field/118176 "2018-02-02T07:37:49Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![happyvivek](https://avatars.discourse-cdn.com/v4/letter/h/8baadc/32.png) [@happyvivek](https://discuss.elastic.co/u/happyvivek)\
**Post date:** [February 2, 2018, 7:37am UTC](https://discuss.elastic.co/t/unable-to-saperate-logs-from-message-field/118176/1 "2018-02-02T07:37:49Z")

</div>

Hi,

My Log Files look like below.I am using multiline to combine all lines to previous lines till select\*.

I want ResultSet value to be in different field.  
And rest of message in LOG field.

Can somebody please help on this?

select \* from TIB\_CLE\_PROD.LOG WHERE LAST\_INTERVAL\_TIME BETWEEN to\_timestamp('2018-02-02 13:02:54.565001000','YYYY-MM-DD HH24:MI:SS,FF9') AND to\_timestamp('2018-02-02 13:02:59.857000000','YYYY-MM-DD HH24:MI:SS,FF9')  
ResultSet: 12197  
Returning connection...  
select \* from TIB\_CLE\_PROD.LOG WHERE LAST\_INTERVAL\_TIME BETWEEN to\_timestamp('2018-02-02 13:02:59.857001000','YYYY-MM-DD HH24:MI:SS,FF9') AND to\_timestamp('2018-02-02 13:03:02.755000000','YYYY-MM-DD HH24:MI:SS,FF9')  
ResultSet: 4717  
Returning connection...  
select \* from TIB\_CLE\_PROD.LOG WHERE LAST\_INTERVAL\_TIME BETWEEN to\_timestamp('2018-02-02 13:03:02.755001000','YYYY-MM-DD HH24:MI:SS,FF9') AND to\_timestamp('2018-02-02 13:03:04.481000000','YYYY-MM-DD HH24:MI:SS,FF9')  
ResultSet: 4413

Below is the grog pattern i am using-

input {  
file {  
path =\> "/app/jep\_utility/logs/\*.log"  
start\_position =\> beginning  
ignore\_older =\> 0  
type =\> "utilityjobs"  
codec =\> multiline{  
pattern =\> "^select"  
max\_lines =\> 10000  
what =\> "previous"  
negate =\> true  
}

```
}

```

}  
filter{  
if [type] == "utilityjobs"{

```
grok {
    match => {"message" => "%{GREEDYDATA:LOGS}"}

```

}  
}  
}  
output {  
elasticsearch {  
hosts =\> ["\*\*\*\*\*\*\*:9200"]  
index =\> "jeputility-%{+YYYY.MM.dd}"  
user =\> \*\*\*\*\*  
password =\> \*\*\*\*\*

```
}

```

}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 2, 2018, 7:38am UTC](https://discuss.elastic.co/t/unable-to-saperate-logs-from-message-field/118176/2 "2018-03-02T07:38:14Z")

</div>

Closed on March 2, 2018, 7:38am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.