# Does multiline codec expects log message into a field called \<message\> field for processing?

**URL:** <https://discuss.elastic.co/t/does-multiline-codec-expects-log-message-into-a-field-called-message-field-for-processing/219636>\
**Category:** Logstash\
**Created:** [February 17, 2020, 2:08pm UTC](https://discuss.elastic.co/t/does-multiline-codec-expects-log-message-into-a-field-called-message-field-for-processing/219636 "2020-02-17T14:08:36Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Febin\_Stephen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/febin_stephen/32/62827_2.png) [@Febin\_Stephen](https://discuss.elastic.co/u/Febin_Stephen)\
**Post date:** [February 17, 2020, 2:08pm UTC](https://discuss.elastic.co/t/does-multiline-codec-expects-log-message-into-a-field-called-message-field-for-processing/219636/1 "2020-02-17T14:08:36Z")

</div>

We collect logs from journald default location where docker containers puts logs through stderr/stdout. default field name for log message is "log". If i want to use multi codec plugin inside logstash does it expect log message in a "message" field, if yes how can i specify a field name ?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 17, 2020, 3:14pm UTC](https://discuss.elastic.co/t/does-multiline-codec-expects-log-message-into-a-field-called-message-field-for-processing/219636/2 "2020-02-17T15:14:58Z")

</div>

A multiline codec always creates events with a field called [message]. You cannot configure that.

---

<div class="post-metadata">

**Author:** ![Febin\_Stephen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/febin_stephen/32/62827_2.png) [@Febin\_Stephen](https://discuss.elastic.co/u/Febin_Stephen)\
**Post date:** [February 17, 2020, 3:32pm UTC](https://discuss.elastic.co/t/does-multiline-codec-expects-log-message-into-a-field-called-message-field-for-processing/219636/3 "2020-02-17T15:32:32Z")

</div>

What if my input is in json format with other fields. The apllication container log is in field called "log" along with other kuberetes metadata inforamation. in this case how can i configure multiline to work ??

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 16, 2020, 3:32pm UTC](https://discuss.elastic.co/t/does-multiline-codec-expects-log-message-into-a-field-called-message-field-for-processing/219636/4 "2020-03-16T15:32:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.