# ELK 5--multiline codec not working with imap

**URL:** <https://discuss.elastic.co/t/elk-5-multiline-codec-not-working-with-imap/65419>\
**Category:** Logstash\
**Created:** [November 8, 2016, 10:52pm UTC](https://discuss.elastic.co/t/elk-5-multiline-codec-not-working-with-imap/65419 "2016-11-08T22:52:37Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![seanziee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/seanziee/32/45151_2.png) [@seanziee](https://discuss.elastic.co/u/seanziee)\
**Post date:** [November 8, 2016, 10:52pm UTC](https://discuss.elastic.co/t/elk-5-multiline-codec-not-working-with-imap/65419/1 "2016-11-08T22:52:37Z")

</div>

Hi,

I keep getting these two messages in my logstash log when trying to run my config file. I have tried just about every combination I can think of and I still cannot get this error to go away. I have run this code with a file input with no problem, but the moment I change to imap, this error occurs. The moment I take away the multiline codec and put a one line input through imap, it works.

> [2016-11-08T17:40:27,142][ERROR][logstash.pipeline] Exception in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash. {"exception"=\>#\<NoMethodError: undefined method `cancelled?' for #<Array:0x1017c494>>, "backtrace"=>["/usr/share/logstash/logstash-core/lib/logstash/util/wrapped_synchronous_queue.rb:186:in `each'", "org/jruby/RubyHash.java:1342:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/util/wrapped_synchronous_queue.rb:185:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:258:in `filter_batch'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:246:in `worker\_loop'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:225:in `start_workers'"]} [2016-11-08T17:40:27,232][FATAL][logstash.runner] An unexpected error occurred! {:error=>#<NoMethodError: undefined method `cancelled?' for #Array:0x1017c494\>, :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/util/wrapped\_synchronous\_queue.rb:186:in `each'", "org/jruby/RubyHash.java:1342:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/util/wrapped\_synchronous\_queue.rb:185:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:258:in `filter\_batch'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:246:in `worker_loop'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:225:in `start\_workers'"]}

My code is as printed below:

> input{  
> imap {  
> codec =\> multiline {  
> pattern =\> "^\s"  
> what =\> previous  
> }  
> host =\> "[imap.gmail.com](http://imap.gmail.com)"  
> user =\> "[XXXX@gmail.com](mailto:XXXX@gmail.com)"  
> password =\> "XXXXXXX"  
> port =\> 993  
> secure =\> true  
> check\_interval =\> 30 # Specified in seconds  
> fetch\_count =\> 1  
> }  
> }

> filter {  
> grok {  
> match =\> {"message" =\> "(?m)%{TIMESTAMP\_ISO8601:timestamp} %{LOGLEVEL:severity} %{GREEDYDATA:message}"}  
> }  
> }

> output {  
> elasticsearch {  
> hosts =\> ["localhost:9200"]  
> }  
> }

And a sample input log is below, which I have tested with the grok constructor with no error-- it would be a different error if it was an issue with my filter I'd imagine.

```
2015-03-24 11:11:58,666 ERROR Processing request failed kafka.common.FailedToSendMessageException: Failed to send messages after 3 tries.
         at kafka.producer.async.DefaultEventHandler.handle(DefaultEventHandler.scala:90)
         at kafka.producer.Producer.send(Producer.scala:77)
         at kafka.javaapi.producer.Producer.send(Producer.scala:42)

```

I've looked all over and this error/exception doesn't seem to appear on any discussion.

Thanks alot!

---

<div class="post-metadata">

**Author:** ![seanziee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/seanziee/32/45151_2.png) [@seanziee](https://discuss.elastic.co/u/seanziee)\
**Post date:** [November 10, 2016, 4:22pm UTC](https://discuss.elastic.co/t/elk-5-multiline-codec-not-working-with-imap/65419/2 "2016-11-10T16:22:13Z")

</div>

So I took multiline out of my code entirely, and my multiline message is still perfectly imported! Is the multiline codec not necessary anymore? I'm happy it's working at least!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 8, 2016, 4:22pm UTC](https://discuss.elastic.co/t/elk-5-multiline-codec-not-working-with-imap/65419/3 "2016-12-08T16:22:19Z")

</div>

Closed on December 8, 2016, 4:22pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.