# Allow logstash to store multi-line messages
**URL:** https://discuss.elastic.co/t/allow-logstash-to-store-multi-line-messages/132308
**Category:** Logstash
**Created:** [May 17, 2018, 10:35am UTC](https://discuss.elastic.co/t/allow-logstash-to-store-multi-line-messages/132308 "2018-05-17T10:35:48Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@SumitV](https://discuss.elastic.co/u/SumitV)
#### Post date: [May 17, 2018, 10:35am UTC](https://discuss.elastic.co/t/allow-logstash-to-store-multi-line-messages/132308/1 "2018-05-17T10:35:49Z")
In my application, i am using filebeat-\>logstash-\>elasticsearch-\>kibana. Here filebeat is listening to a folder location(/XYZ/\*.log)
This log file contains logs where messages can be in the form of multi-line.
For example, below are 3 log messages.
2018-05-07 04:30:00,954 [1] INFO WMK\_Production.WMK\_Production - Starting Welcome Kit production.
2018-05-07 04:30:01,579 [1] ERROR WMK\_Production.WMK\_Production - Unexpected error processing Welcome Kit production, cause: Specified argument was out of the range of valid values.
Parameter name: MaxDegreeOfParallelism.
System.ArgumentOutOfRangeException: Specified argument was out of the range of valid values.
Parameter name: MaxDegreeOfParallelism
at System.Threading.Tasks.ParallelOptions.set\_MaxDegreeOfParallelism(Int32 value)
at WMK\_Production.WMK\_Production.Main() in D:..\Builds\SBS.Test.Build.WMK.Production\WMK\_Production\WMK\_Production.vb:line 106
2018-05-07 04:30:01,611 [1] DEBUG WMK\_Production.WMK\_Production - Sending notification email to: [abc@zys.com](mailto:abc@zys.com), from: [XYZ@ABC.com](mailto:XYZ@ABC.com), on SMTP host: [xyz.com](http://xyz.com).
In above 3 logs, 1st and 3rd logs are represented in a single line in log file, but 2nd log's error message is divided in multiple lines.
in my logstash conf file i am using below code in filter.
filter {
grok{
match =\> {"message" =\> "%{TIMESTAMP\_ISO8601:timestamp} [%{NUMBER:number}] %{LOGLEVEL:loglevel} %{GREEDYDATA:file} - (?(.|\r|\n)\*)"}
}
For single line log info, this works perfectly fine. But for 2nd log, filebeat itself is creating different events for each line, so ideally filebeat should return 3 events, but it is creating 8 events. 6 events for error log which ideally should send only 1. More over i need all new line log message as msg field.
My questions
1. Where i need to make changes in order to get only 3 events, logstash or filebeat?
2. What changes need to do in order to achieve this.
Thanks,
Sumit
---
### Author:  [@paz](https://discuss.elastic.co/u/paz)
#### Post date: [May 17, 2018, 11:37am UTC](https://discuss.elastic.co/t/allow-logstash-to-store-multi-line-messages/132308/2 "2018-05-17T11:37:41Z")
You need to configure Filebeat appropriately to handle [multiline](https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html) messages when reading a file.
The examples listed there should help you get started.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 14, 2018, 11:37am UTC](https://discuss.elastic.co/t/allow-logstash-to-store-multi-line-messages/132308/3 "2018-06-14T11:37:41Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.