# Writing multiline grok
**URL:** https://discuss.elastic.co/t/writing-multiline-grok/178214
**Category:** Logstash
**Created:** [April 24, 2019, 10:02am UTC](https://discuss.elastic.co/t/writing-multiline-grok/178214 "2019-04-24T10:02:07Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@Vikash\_Singh1](https://discuss.elastic.co/u/Vikash_Singh1)
#### Post date: [April 24, 2019, 10:02am UTC](https://discuss.elastic.co/t/writing-multiline-grok/178214/1 "2019-04-24T10:02:07Z")
HI I am trying to write grok for apache mod security logs.
GET /images/new2.gif HTTP/1.1
Accept: _/_
Referer: [http://www.rrcat.gov.in/](http://www.rrcat.gov.in/)
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.rrcat.gov.in
X-Forwarded-For: 131.225.32.36
If-Modified-Since: Tue, 23 Feb 2016 05:48:34 GMT
Cache-Control: max-stale=0
Connection: Keep-Alive
Pragma: no-cache
X-BlueCoat-Via: 7060c08b1ceaae72
Above is the sample input for my file
although I have decoded the first line but can't understand how to decode the next lines
Please help me with it
The grok pattern for first line is
%{WORD:method}%{SPACE}%{URIPATHPARAM:request}%{SPACE}%{WORD:protocol}
---
### Author:  [@Vikash\_Singh1](https://discuss.elastic.co/u/Vikash_Singh1)
#### Post date: [April 24, 2019, 10:03am UTC](https://discuss.elastic.co/t/writing-multiline-grok/178214/2 "2019-04-24T10:03:19Z")
Grok pattern in above message is wrong...the correct one is:
%{CISCO\_REASON:method}%{URIPATHPARAM:access}%{SPACE}%{WORD:protocol}/%{NUMBER:version}
---
### Author:  [@Vikash\_Singh1](https://discuss.elastic.co/u/Vikash_Singh1)
#### Post date: [April 24, 2019, 11:26am UTC](https://discuss.elastic.co/t/writing-multiline-grok/178214/3 "2019-04-24T11:26:43Z")
Like what should I do to segregate the next lines..
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 24, 2019, 2:33pm UTC](https://discuss.elastic.co/t/writing-multiline-grok/178214/4 "2019-04-24T14:33:57Z")
You could match against an array of patterns.
```
grok {
match => {
"message" => [
"^Accept: %{GREEDYDATA:accept}",
"^Referer: %{GREEDYDATA:referrer}",
"^Accept-Language: %{GREEDYDATA:accept-language}",
"^User-Agent: %{GREEDYDATA:user-agent}",
"^Accept-Encoding: %{GREEDYDATA:accept-encoding}"
]
}
}
```
---
### Author:  [@Vikash\_Singh1](https://discuss.elastic.co/u/Vikash_Singh1)
#### Post date: [April 25, 2019, 5:11am UTC](https://discuss.elastic.co/t/writing-multiline-grok/178214/5 "2019-04-25T05:11:52Z")
My full grok will look like:
grok {
match =\> {
"message" =\> [ %{CISCO\_REASON:method} %{URIPATHPARAM:access} %{URIPROTO:http\_proto}/%{NUMBER:version}
"^Accept: %{GREEDYDATA:accept}",
"^Referer: %{GREEDYDATA:referrer}",
"^Accept-Language: %{GREEDYDATA:accept-language}",
"^User-Agent: %{GREEDYDATA:user-agent}",
"^Accept-Encoding: %{GREEDYDATA:accept-encoding}"
]
}
}
???
---
### Author:  [@Vikash\_Singh1](https://discuss.elastic.co/u/Vikash_Singh1)
#### Post date: [April 25, 2019, 5:18am UTC](https://discuss.elastic.co/t/writing-multiline-grok/178214/6 "2019-04-25T05:18:58Z")
I am trying to match the pattern in Grok debugger (Dev Tool) in kibana.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 25, 2019, 2:01pm UTC](https://discuss.elastic.co/t/writing-multiline-grok/178214/7 "2019-04-25T14:01:11Z")
You would probably want to set 'break\_on\_match =\> false' if you configure it that way.
---
### Author:  [@Vikash\_Singh1](https://discuss.elastic.co/u/Vikash_Singh1)
#### Post date: [April 26, 2019, 5:46am UTC](https://discuss.elastic.co/t/writing-multiline-grok/178214/8 "2019-04-26T05:46:39Z")
I tried but facing problems in my grok. My grok looks like
input {
file {
path =\> "/elk/Weblog/\*"
start\_position =\> "beginning"
}
}
filter
{
grok {
break\_on\_match =\> false
match =\> { "message" =\> "%{CISCO\_REASON:method}" "%{URIPATHPARAM:access}" "%{URIPROTO:http\_proto}"/"%{NUMBER:version}",
"^Accept: %{GREEDYDATA:accept}",
"^Referer: %{GREEDYDATA:referrer}",
"^Accept-Language: %{GREEDYDATA:accept-language}",
"^User-Agent: %{GREEDYDATA:user-agent}",
"^Accept-Encoding: %{GREEDYDATA:accept-encoding}"}
```
}
```
}
output
{
elasticsearch {
hosts =\> ["10.11.109.7:9200"]
index =\> "logstash\_apchelogs"
}
}
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 24, 2019, 5:46am UTC](https://discuss.elastic.co/t/writing-multiline-grok/178214/9 "2019-05-24T05:46:41Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.