CSV Input - Some fields are multiline - LR vs CRLF

I am trying input a csv file that certain fields can be multiline. When I paste the sample data into Notepad++ and display end of line characters, I can see the actual csv line separates using CRLF but the new lines within a field use LF. I want all lines within one field to be one value in Elastic. Below is my input code. Any suggestions on how to input this properly?

  file {
    path => "/home/ubuntu/csv_inputs/sca/*.csv"
    start_position => "beginning"
    sincedb_path => "/dev/null"

    codec => multiline {
      pattern => "\lf"
      negate => true
      what => previous


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.