# Disable/enable multiline codec when using clone filter

**URL:** <https://discuss.elastic.co/t/disable-enable-multiline-codec-when-using-clone-filter/214942>\
**Category:** Logstash\
**Created:** [January 14, 2020, 8:00am UTC](https://discuss.elastic.co/t/disable-enable-multiline-codec-when-using-clone-filter/214942 "2020-01-14T08:00:35Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![nino](https://avatars.discourse-cdn.com/v4/letter/n/b9bd4f/32.png) [@nino](https://discuss.elastic.co/u/nino)\
**Post date:** [January 14, 2020, 8:00am UTC](https://discuss.elastic.co/t/disable-enable-multiline-codec-when-using-clone-filter/214942/1 "2020-01-14T08:00:35Z")

</div>

Hello all,

is it posible to disable multiline when using clone filter?. For instance:

```
input{

    codec => multiline { 
          pattern => "^ImposibleMatch"
          negate => true
          what => previous
          auto_flush_interval => 1
          multiline_tag => ""
        }
    }

    filter{

       clone { clones => ["multilineOff"] } 

       if [type] == "multilineOff" {
          ### treat file as no multiline, one line, one event (bypassing multiline code on input) 
       }
       else{
          ### treat file as multiline (input multiline codec takes effect) 
       }

}

```

Best regards

---

<div class="post-metadata">

**Author:** ![nino](https://avatars.discourse-cdn.com/v4/letter/n/b9bd4f/32.png) [@nino](https://discuss.elastic.co/u/nino)\
**Post date:** [January 14, 2020, 2:24pm UTC](https://discuss.elastic.co/t/disable-enable-multiline-codec-when-using-clone-filter/214942/2 "2020-01-14T14:24:08Z")

</div>

Any suggestion about that?. My question it's about, what happens when we have to divide a file in two or more indexes.

Best regards

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 14, 2020, 2:39pm UTC](https://discuss.elastic.co/t/disable-enable-multiline-codec-when-using-clone-filter/214942/3 "2020-01-14T14:39:11Z")

</div>

If you have combined multiple lines into a single event you could split that event into multiple events using a [split](https://www.elastic.co/guide/en/logstash/current/plugins-filters-split.html) filter.

---

<div class="post-metadata">

**Author:** ![nino](https://avatars.discourse-cdn.com/v4/letter/n/b9bd4f/32.png) [@nino](https://discuss.elastic.co/u/nino)\
**Post date:** [January 14, 2020, 2:50pm UTC](https://discuss.elastic.co/t/disable-enable-multiline-codec-when-using-clone-filter/214942/4 "2020-01-14T14:50:46Z")

</div>

Thank you Badger. I am wondering which would be the best approach. Maybe the best approach if you have to divide the same file in several indexes would be create as pipelines as indexes we need. What do you think about this approach? One pipeline per index to route for, just to avoid very large conf files (pipelines) or better maintenance, could you give me some advice?

Best regards

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 14, 2020, 3:45pm UTC](https://discuss.elastic.co/t/disable-enable-multiline-codec-when-using-clone-filter/214942/5 "2020-01-14T15:45:46Z")

</div>

The [forked-path](https://www.elastic.co/guide/en/logstash/current/pipeline-to-pipeline.html#forked-path-pattern) pattern to process the same data in multiple ways is a good approach.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 11, 2020, 3:45pm UTC](https://discuss.elastic.co/t/disable-enable-multiline-codec-when-using-clone-filter/214942/6 "2020-02-11T15:45:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.