# Defaulting pipeline worker threads to 1

**URL:** https://discuss.elastic.co/t/defaulting-pipeline-worker-threads-to-1/68465
**Category:** Logstash
**Created:** [December 8, 2016, 6:24pm UTC](https://discuss.elastic.co/t/defaulting-pipeline-worker-threads-to-1/68465 "2016-12-08T18:24:00Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Honda\_fred\_elk](https://avatars.discourse-cdn.com/v4/letter/h/919ad9/32.png) [@Honda\_fred\_elk](https://discuss.elastic.co/u/Honda_fred_elk)
#### Post date: [December 8, 2016, 6:24pm UTC](https://discuss.elastic.co/t/defaulting-pipeline-worker-threads-to-1/68465/1 "2016-12-08T18:24:00Z")

</div>

Hello,

I have following config for logstash..

input {  
file {  
path =\> "/appl/log/TestLogs/\*.log"  
start\_position =\> "beginning"   
sincedb\_path =\> "/appl/log/sincedbloc/sincedbfile.txt"  
}  
}

filter{  
multiline{  
pattern =\> "[#|\d{4}"  
negate =\> true  
what =\> "previous"  
}

grok{  
match =\> {"message" =\> "%{DATESTAMP:time-stamp}%{SPACE}%{LOGLEVEL:log-level}%{SPACE}%{DATA:class}:%{SPACE}%{GREEDYDATA:log-message}" }  
}  
}

output {  
elasticsearch { hosts =\> ["localhost:9200"] }  
stdout{}  
file{  
path =\> "/appl/log/TestLogsOutput/LogStash\_output.log"  
}  
}

As soon as I introduced multiline filter and restarted logstash.. I got following message..

Defaulting pipeline worker threads to 1 because there are some filters that might not work with multiple worker threads", :count\_was=\>4, :filters=\>["multiline"], :level=\>:warn}  
blogs suggest to use FileBeat..

Can anyone advice is there any alternate or I should go with FileBeat?

Thanks  
Fredrick

---

<div class="post-metadata">

### Author: ![Bevan](https://avatars.discourse-cdn.com/v4/letter/b/9fc29f/32.png) [@Bevan](https://discuss.elastic.co/u/Bevan)
#### Post date: [December 8, 2016, 8:42pm UTC](https://discuss.elastic.co/t/defaulting-pipeline-worker-threads-to-1/68465/2 "2016-12-08T20:42:57Z")

</div>

You can use the multiline codec to the file input instead of having it as a separate filter.

As a standalone filter stage, multiline forces a single threaded approach because otherwise it can't tell which line came from which file.

We use:

> ```
> file {
> type => "foobar"
> path => [ "/var/log/foobar/foo.log",
> "/var/log/foobar/bar.log",
> "/var/log/foobar/baz.log"
> ]
> codec => multiline {
> pattern => "^\d{4}-\d{2}-\d{2}\@\d{2}:\d{2}:\d{2}(\.\d{1,4})?"
> negate => true
> what => "previous"
> }
> }
> 
> ```

...for exactly that reason.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 5, 2017, 8:42pm UTC](https://discuss.elastic.co/t/defaulting-pipeline-worker-threads-to-1/68465/3 "2017-01-05T20:42:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.