# Can't input in logstash for multiline
**URL:** https://discuss.elastic.co/t/cant-input-in-logstash-for-multiline/158003
**Category:** Logstash
**Created:** [November 23, 2018, 12:15pm UTC](https://discuss.elastic.co/t/cant-input-in-logstash-for-multiline/158003 "2018-11-23T12:15:12Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Denis\_Neres](https://discuss.elastic.co/u/Denis_Neres)
#### Post date: [November 23, 2018, 12:15pm UTC](https://discuss.elastic.co/t/cant-input-in-logstash-for-multiline/158003/1 "2018-11-23T12:15:12Z")
Hello guys, so I have a specific pattern of logs that loogs like this:
```auto
[2018-11-17 11:10:26.267] [s-ss-ares] [http-apr-8080-exec-1] ERROR b.c.s.g.p.s.s.DashboardServiceImpl@logException:41 - [testesemp] - [Supervisor 003] - [super003@geosales] nested exception is org.apache.ibatis.exceptions.PersistenceException:
###message comes here
###other message here
###more here
at bablablablabablablabla.bablablabla.bablablabla
at blablablablablablablab
at bablablablabablablabla.bablablabla.bablablabla
at blablablablablablablab
[2018-11-17 11:10:26.267] [s-ss-ares] [http-apr-8080-exec-1] ERROR b.c.s.g.p.s.s.DashboardServiceImpl@logException:41 - [testesemp] - [Supervisor 003] - [super003@geosales] nested exception is org.apache.ibatis.exceptions.PersistenceException:
[2018-11-17 11:10:26.267] [s-ss-ares] [http-apr-8080-exec-1] ERROR b.c.s.g.p.s.s.DashboardServiceImpl@logException:41 - [testesemp] - [Supervisor 003] - [super003@geosales] nested exception is org.apache.ibatis.exceptions.PersistenceException:
```
So I did this configuration for **input on logstash** to capture multiline logs (all those starting with '#' and with whitespace...)
```auto
input {
file {
path => "path/to/my/log/file.log"
codec => multiline {
pattern => "^%{TIMESTAMP_ISO8601} "
negate => true
what => previous
}
}
}
```
What´s wrong? it isn´t to get all lines that doesn't start with date and set to the previous log with date?
thanks for your attention
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [November 23, 2018, 12:16pm UTC](https://discuss.elastic.co/t/cant-input-in-logstash-for-multiline/158003/2 "2018-11-23T12:16:42Z")
Before the timestamp is a `[` that seems to be missing from your pattern.
---
### Author:  [@Denis\_Neres](https://discuss.elastic.co/u/Denis_Neres)
#### Post date: [November 23, 2018, 12:24pm UTC](https://discuss.elastic.co/t/cant-input-in-logstash-for-multiline/158003/3 "2018-11-23T12:24:38Z")
yeah, I thought would be this, but I tried `pattern => "\[^%{TIMESTAMP_ISO8601}\]"`and still didn't work. Or is this wrong?
---
### Author:  [@Denis\_Neres](https://discuss.elastic.co/u/Denis_Neres)
#### Post date: [November 23, 2018, 12:51pm UTC](https://discuss.elastic.co/t/cant-input-in-logstash-for-multiline/158003/4 "2018-11-23T12:51:37Z")
I also tried this: `pattern => "^\[%{TIMESTAMP_ISO8601}\] "`, nothing yet ☹
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [November 23, 2018, 12:58pm UTC](https://discuss.elastic.co/t/cant-input-in-logstash-for-multiline/158003/5 "2018-11-23T12:58:15Z")
What if you try e.g. `^\[\d{4}-\d{2}-\d{2} \d{2}`?
---
### Author:  [@Denis\_Neres](https://discuss.elastic.co/u/Denis_Neres)
#### Post date: [November 23, 2018, 1:29pm UTC](https://discuss.elastic.co/t/cant-input-in-logstash-for-multiline/158003/6 "2018-11-23T13:29:32Z")
So, updating informations:
- I did this: **^[\d{4}-\d{2}-\d{2} \d{2}** and didn't work at all.
- I put this: **^[%{TIMESTAMP\_ISO8601}]** and I noticed something interesting: When I take out the 'at blbalba.blablabla.balba' logs, it did capture the logs perfectly. So, the problem is that This pattern can't capture logs line starting with:
```auto
(white space) at dome.text.over.here
(white space) at dome.text.over.here
(white space) at dome.text.over.here
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 21, 2018, 1:40pm UTC](https://discuss.elastic.co/t/cant-input-in-logstash-for-multiline/158003/7 "2018-12-21T13:40:37Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.