# Using input field for pattern matching

**URL:** https://discuss.elastic.co/t/using-input-field-for-pattern-matching/40651
**Category:** Logstash
**Created:** [February 1, 2016, 4:14pm UTC](https://discuss.elastic.co/t/using-input-field-for-pattern-matching/40651 "2016-02-01T16:14:53Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Dheeraj](https://avatars.discourse-cdn.com/v4/letter/d/c37758/32.png) [@Dheeraj](https://discuss.elastic.co/u/Dheeraj)
#### Post date: [February 1, 2016, 4:14pm UTC](https://discuss.elastic.co/t/using-input-field-for-pattern-matching/40651/1 "2016-02-01T16:14:53Z")

</div>

Hi,

Is it possible to use an input field to match the pattern via multiline/grok filter. For example, following doesn't work :

```
 multiline {
   pattern => [log_pattern]
   negate => true
   what => "previous"
   source => "data"
}

```

Use case:  
I am trying to setup a logstash multiline parser with inputs from different applications. I'd like to make the applications set a pattern field which will be used for matching.

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [February 1, 2016, 5:34pm UTC](https://discuss.elastic.co/t/using-input-field-for-pattern-matching/40651/2 "2016-02-01T17:34:20Z")

</div>

Theoretically,

```auto
multiline {
  pattern => "%{log_pattern}"
  ...
}

```

could be made to work for a multiline filter, but then every single event would need to have a `log_pattern` field. Except for a few plugins (like multiline), Logstash doesn't keep any state between events.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:13am UTC](https://discuss.elastic.co/t/using-input-field-for-pattern-matching/40651/3 "2017-07-06T05:13:31Z")

</div>


