# AWS streaming multi-line log files from CloudWatch to ELK

**URL:** <https://discuss.elastic.co/t/aws-streaming-multi-line-log-files-from-cloudwatch-to-elk/156135>\
**Category:** Elasticsearch\
**Created:** [November 10, 2018, 12:28pm UTC](https://discuss.elastic.co/t/aws-streaming-multi-line-log-files-from-cloudwatch-to-elk/156135 "2018-11-10T12:28:41Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![0b3d953a632983bedb48](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/0b3d953a632983bedb48/32/37499_2.png) [@0b3d953a632983bedb48](https://discuss.elastic.co/u/0b3d953a632983bedb48)\
**Post date:** [November 10, 2018, 12:28pm UTC](https://discuss.elastic.co/t/aws-streaming-multi-line-log-files-from-cloudwatch-to-elk/156135/1 "2018-11-10T12:28:42Z")

</div>

We are streaming app logs from CloudWatch to AWS ELK. Our microservices are written in Java and so I am only concentrating on those. A typical java exception stack trace when logged looks like this:

Exception in thread "main" java.lang.NullPointerException  
at com.example.myproject.Book.getTitle(Book.java:16)  
at com.example.myproject.Author.getBookTitles(Author.java:25)  
at com.example.myproject.Bootstrap.main(Bootstrap.java:14)

Normally, this will be ingested line by line in ELK stack, which breaks the entire message.

Usually, For entire stack trace to be ingested as a single message, one can configure multiline plugin either in Logstash or Filebeat.

Any idea how to enable multiline while streaming log files from CloudWatch to ELK by AWS lambda?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 8, 2018, 12:28pm UTC](https://discuss.elastic.co/t/aws-streaming-multi-line-log-files-from-cloudwatch-to-elk/156135/2 "2018-12-08T12:28:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
