# Codec Multiline Patterns doesn\`t work

**URL:** <https://discuss.elastic.co/t/codec-multiline-patterns-doesn-t-work/183758>\
**Category:** Logstash\
**Created:** [May 31, 2019, 3:34pm UTC](https://discuss.elastic.co/t/codec-multiline-patterns-doesn-t-work/183758 "2019-05-31T15:34:07Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Carlos.limaElaw](https://avatars.discourse-cdn.com/v4/letter/c/ec9cab/32.png) [@Carlos.limaElaw](https://discuss.elastic.co/u/Carlos.limaElaw)\
**Post date:** [May 31, 2019, 3:34pm UTC](https://discuss.elastic.co/t/codec-multiline-patterns-doesn-t-work/183758/1 "2019-05-31T15:34:07Z")

</div>

Hi, there

I'm trying to use the codec multiline in my input, because some lines of my file csv come like this:

> 2019052238000853;RES: DADOS PARA O CADASTRO DO ELAW;2019-05-22 09:48:08;2019-05-22 10:06:05;;Consultores;new;leandro.coelho@viavarejo.com.br;Via Varejo;ADM::CRIAÇÃO DE USUÁRIO;SLA - Medio;Ajuste/Correção em Configurações;rogerio.owsiany;0;2;Leliana Souza;;Sem atuação;;Sem atuação;"Criar acesso para  
> NOME  
> CPF  
> E-MAIL  
> Larissa Santana Garcia  
> 094.350.614-00  
> larissa.garcia@wsb.adv.br  
> Maria das Dores Alves de Menezes  
> 107.243.164-50  
> maria.menezes@wsb.adv.br  
> Ana Luiza Lacerda Cunha  
> 089.140.404-02  
> ana.lacerda@wsb.adv.br  
> Ana Caroline Araújo de Andrade  
> 700.856.754-58  
> ana.araujo@wsb.adv.br";Não;

A right one is like this:

> 2019052238000862;CONTRATO: Definir responsável pelo contrato - null;2019-05-22 09:48:11;2019-05-22 10:10:01;2019-05-22 10:10:01;Junk;closed successful;minerva@elaw.com.br;minerva@elaw.com.br;;;Não Classificado;root@localhost;21;1;;;;;;;Não;

No line breaks.

My codec multiline patterns:

> codec =\> multiline {  
> pattern =\> "\[1\]{16};(?:._);;[\r\n|\r\n|\r|\n| |  
> ]$|\[2\]{16};(?:._);Não;[\r\n|\r\n|\r|\n| |  
> ]$|\[3\]{16};(?:._);Sim;[\r\n|\r\n|\r|\n| |  
> ]$|\[4\]{16};(?:._);;$|\[5\]{16};(?:._);Não;$|\[6\]{16};(?:._);Sim;$"  
> negate =\> true  
> what =\> "next"  
> multiline\_tag =\> "multiline"  
> charset =\> "UTF-8"  
> }

I tried to put every possible finals for the right line, even literally the line break.

but my "message" is comming like this:

> 2019052238000853;RES: DADOS PARA O CADASTRO DO ELAW;2019-05-22 09:48:08;2019-05-22 10:06:05;;Consultores;new;leandro.coelho@viavarejo.com.br;Via Varejo;ADM::CRIAÇÃO DE USUÁRIO;SLA - Medio;Ajuste/Correção em Configurações;rogerio.owsiany;0;2;Leliana Souza;;Sem atuação;;Sem atuação;"Criar acesso para  
> NOME  
> CPF  
> E-MAIL  
> Larissa Santana Garcia  
> 094.350.614-00  
> larissa.garcia@wsb.adv.br  
> Maria das Dores Alves de Menezes  
> 107.243.164-50  
> maria.menezes@wsb.adv.br  
> Ana Luiza Lacerda Cunha  
> 089.140.404-02  
> ana.lacerda@wsb.adv.br  
> Ana Caroline Araújo de Andrade  
> 700.856.754-58  
> ana.araujo@wsb.adv.br";Não;  
> 2019052238000844;RES: Erro Sistema Elaw;2019-05-22 09:48:07;2019-05-22 10:05:23;2019-05-22 10:05:23;Suporte;closed [successful;Fernanda.Cardoso@walmart.com](mailto:successful;Fernanda.Cardoso@walmart.com);Walmart;AMBIENTES::QUEDA DO AMBIENTE;SLA - Alto;Duvida;leliana.souza;17;2;Leliana Souza;;Sem atuação;;Sem atuação;Queda ambiente;Não;

The final of event is "ana.araujo@wsb.adv.br";Não;", but it's matching with next line.

Am I doing something wrorg?

Thanks.

* * *

1. 0-9 

2. 0-9 

3. 0-9 

4. 0-9 

5. 0-9 

6. 0-9

---

<div class="post-metadata">

**Author:** ![pastechecker](https://avatars.discourse-cdn.com/v4/letter/p/0ea827/32.png) [@pastechecker](https://discuss.elastic.co/u/pastechecker)\
**Post date:** [May 31, 2019, 3:38pm UTC](https://discuss.elastic.co/t/codec-multiline-patterns-doesn-t-work/183758/2 "2019-05-31T15:38:05Z")

</div>

Do you have a possibility to flatten your file before processing?

---

<div class="post-metadata">

**Author:** ![Carlos.limaElaw](https://avatars.discourse-cdn.com/v4/letter/c/ec9cab/32.png) [@Carlos.limaElaw](https://discuss.elastic.co/u/Carlos.limaElaw)\
**Post date:** [May 31, 2019, 3:42pm UTC](https://discuss.elastic.co/t/codec-multiline-patterns-doesn-t-work/183758/3 "2019-05-31T15:42:25Z")

</div>

No... I have to render the CSV as it comes

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 28, 2019, 3:53pm UTC](https://discuss.elastic.co/t/codec-multiline-patterns-doesn-t-work/183758/4 "2019-06-28T15:53:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.