# Codec multiline grok pattern for Logstash

**URL:** <https://discuss.elastic.co/t/codec-multiline-grok-pattern-for-logstash/351334>\
**Category:** Logstash\
**Created:** [January 18, 2024, 9:23am UTC](https://discuss.elastic.co/t/codec-multiline-grok-pattern-for-logstash/351334 "2024-01-18T09:23:07Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![mangeshmj1992](https://avatars.discourse-cdn.com/v4/letter/m/d9b06d/32.png) [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\
**Post date:** [January 18, 2024, 9:23am UTC](https://discuss.elastic.co/t/codec-multiline-grok-pattern-for-logstash/351334/1 "2024-01-18T09:23:07Z")

</div>

Hey,

so i am parsing multiline logs using Logstash. I need consider each log line will start with `{"offset":` currently it is printing into single line that's why it is coming in one message only

**We are not using file beat hence need to implement in Logstash only**

**The multiline pattern is made in Logstash with sample logs:**

```auto
input {
stdin {
        codec => multiline {
          pattern => "\{\"offset\""
          negate => true
          what => "previous"
        }
      }
  }
  

filter{

	mutate {
		add_field => ["config_version", "v6.2"]
	}
	
}

output {
       stdout{}
	}

```

**Sample Logs:**

```auto
{"offset":3083492288,"@version":"1","remote_ip":"abc","source":"xyz","time":"2024-01-08T12:19:43.421+00:00"}}{"offset":3083492288,"@version":"1","remote_ip":"abc","source":"xyz","time":"2024-01-08T12:19:43.421+00:00"}}

```

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [January 18, 2024, 12:29pm UTC](https://discuss.elastic.co/t/codec-multiline-grok-pattern-for-logstash/351334/2 "2024-01-18T12:29:53Z")

</div>

> [@mangeshmj1992](#):
>
> so i am parsing multiline logs

Can you share an example of this multiline log? What you shared is a single json log line.

---

<div class="post-metadata">

**Author:** ![mangeshmj1992](https://avatars.discourse-cdn.com/v4/letter/m/d9b06d/32.png) [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\
**Post date:** [January 18, 2024, 1:21pm UTC](https://discuss.elastic.co/t/codec-multiline-grok-pattern-for-logstash/351334/3 "2024-01-18T13:21:08Z")

</div>

HI @leandrojmp ,  
yes those logs are generating in singe line only in txt files. but they need each log should start with {"offset": and they don't want to use filebeat as well through logstash only

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [January 18, 2024, 2:31pm UTC](https://discuss.elastic.co/t/codec-multiline-grok-pattern-for-logstash/351334/4 "2024-01-18T14:31:07Z")

</div>

> [@mangeshmj1992](#):
>
> yes those logs are generating in singe line only in txt files.

This is confusing, it is not clear what is the issue, if you have a single line with a json document you do not need multiline and you also not need grok.

Also, if you have log files you should use the `file` input, not `stdin`.

---

<div class="post-metadata">

**Author:** ![mangeshmj1992](https://avatars.discourse-cdn.com/v4/letter/m/d9b06d/32.png) [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\
**Post date:** [January 18, 2024, 2:59pm UTC](https://discuss.elastic.co/t/codec-multiline-grok-pattern-for-logstash/351334/5 "2024-01-18T14:59:51Z")

</div>

> [@leandrojmp](#):
>
> if you have log files you should use the `file` inpu

this one i used for testing purpose only but through file also not working

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [January 18, 2024, 3:58pm UTC](https://discuss.elastic.co/t/codec-multiline-grok-pattern-for-logstash/351334/6 "2024-01-18T15:58:01Z")

</div>

> [@mangeshmj1992](#):
>
> this one i used for testing purpose only but through file also not working

Can you share the multiline log you have?

What you shared is not a multiline log, is a json document, you do not need multiline nor grok to parse it.

A `json` codec would parse your log without any issues.

---

<div class="post-metadata">

**Author:** ![mangeshmj1992](https://avatars.discourse-cdn.com/v4/letter/m/d9b06d/32.png) [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\
**Post date:** [January 18, 2024, 5:55pm UTC](https://discuss.elastic.co/t/codec-multiline-grok-pattern-for-logstash/351334/7 "2024-01-18T17:55:10Z")

</div>

Json is now working here if my multiple logs in single line

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 15, 2024, 5:56pm UTC](https://discuss.elastic.co/t/codec-multiline-grok-pattern-for-logstash/351334/8 "2024-02-15T17:56:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.