# Difference between multiline codec and filter?

**URL:** https://discuss.elastic.co/t/difference-between-multiline-codec-and-filter/37771
**Category:** Logstash
**Created:** [December 22, 2015, 4:18pm UTC](https://discuss.elastic.co/t/difference-between-multiline-codec-and-filter/37771 "2015-12-22T16:18:57Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![CraigFoote](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/craigfoote/32/4571_2.png) [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)
#### Post date: [December 22, 2015, 4:18pm UTC](https://discuss.elastic.co/t/difference-between-multiline-codec-and-filter/37771/1 "2015-12-22T16:18:57Z")

</div>

I'm using the multiline codec in the input section and finding some issues. I just learned there is a multiline filter as well. How does it differ? In particular I have to concatenate discrete log files together as they contain one event each and the multiline codec waits for a new event pattern before releasing previous one into pipeline. It also waits indefinitely before releasing last event for new event to determine if previous event was complete. The result is the last event is never pipelined. Just wondering if filter behaves differently here.

---

<div class="post-metadata">

### Author: ![allenmchan](https://avatars.discourse-cdn.com/v4/letter/a/ec9cab/32.png) [@allenmchan](https://discuss.elastic.co/u/allenmchan)
#### Post date: [December 22, 2015, 6:03pm UTC](https://discuss.elastic.co/t/difference-between-multiline-codec-and-filter/37771/2 "2015-12-22T18:03:19Z")

</div>

This looks like a good write up that says do not use multiline filter

> <https://github.com/elastic/logstash/issues/4386>

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:17am UTC](https://discuss.elastic.co/t/difference-between-multiline-codec-and-filter/37771/3 "2017-07-06T05:17:31Z")

</div>


