# Graylog multiline log processing

**URL:** <https://community.graylog.org/t/graylog-multiline-log-processing/11061>\
**Category:** Graylog Central (peer support)\
**Created:** [July 5, 2019, 7:56am UTC](https://community.graylog.org/t/graylog-multiline-log-processing/11061 "2019-07-05T07:56:06Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jaikumarkrishna](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jaikumarkrishna/32/1101_2.png) [@jaikumarkrishna](https://community.graylog.org/u/jaikumarkrishna)\
**Post date:** [July 5, 2019, 7:56am UTC](https://community.graylog.org/t/graylog-multiline-log-processing/11061/1 "2019-07-05T07:56:06Z")

</div>

Hi ,

I am trying to process below log which contains multiline format using filebeat.

```auto
7/5/2019 7:05:00 AM==> System.Web.HttpException (0x80004005): A public action method 'Id' was not found on controller 'SmartData.EndUserPortal.Web.Controllers.ServiceRequestController'.
   at System.Web.Mvc.Controller.HandleUnknownAction(String actionName)
   at System.Web.Mvc.Controller.<BeginExecuteCore>b__1d(IAsyncResult asyncResult, ExecuteCoreState innerState)
   at System.Web.Mvc.Async.AsyncResultWrapper.WrappedAsyncVoid`1.CallEndDelegate(IAsyncResult asyncResult)
   at System.Web.Mvc.Controller.EndExecuteCore(IAsyncResult asyncResult)
   at System.Web.Mvc.Async.AsyncResultWrapper.WrappedAsyncVoid`1.CallEndDelegate(IAsyncResult asyncResult)
   at System.Web.Mvc.Controller.EndExecute(IAsyncResult asyncResult)
   at System.Web.Mvc.MvcHandler.<BeginProcessRequest>b__5(IAsyncResult asyncResult, ProcessRequestState innerState)
   at System.Web.Mvc.Async.AsyncResultWrapper.WrappedAsyncVoid`1.CallEndDelegate(IAsyncResult asyncResult)
   at System.Web.Mvc.MvcHandler.EndProcessRequest(IAsyncResult asyncResult)
   at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
   at System.Web.HttpApplication.<>c __DisplayClass285_0.<ExecuteStepImpl>b__ 0()
   at System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep step)
   at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)
   

```

**GROK**  
**SmartData** : `(?<timestamp>[0-9]+\/[0-9]+\/[0-9]+\s+[0-9]+\:[0-9]+\:[0-9]+\s+[A-P]{2})\=\=\> %{GREEDYDATA:Message}$`

**Pipeline rule:**

> rule “SmartData”  
> when  
> has\_field(“message”)
> 
> then  
> let pattern = “%{SmartData}”;  
> let matches = grok(pattern: pattern, value: to\_string($message.message));  
> set\_fields(matches);  
> end

Its processing only single line log, How to parse the above multiline log using graylog. Need your help to fix this issue.

**Same grok pattern/REGEX i used to parse the above multiline log ,it parsed as expected in logstash.**

Thanks,  
Jay’

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [July 5, 2019, 4:24pm UTC](https://community.graylog.org/t/graylog-multiline-log-processing/11061/2 "2019-07-05T16:24:09Z")

</div>

the Grok implementation in Graylog does not allow multiline grok pattern…

you might want to `+1` this issue

> <https://github.com/Graylog2/graylog2-server/issues/2465>

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [July 19, 2019, 4:38pm UTC](https://community.graylog.org/t/graylog-multiline-log-processing/11061/3 "2019-07-19T16:38:28Z")

</div>

Closed on July 19, 2019, 4:38pm UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.