# Filebeat with multiline vs. multiline logstash codec **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [January 21, 2016, 6:54pm UTC](https://discuss.elastic.co/t/filebeat-with-multiline-vs-multiline-logstash-codec/39808 "2016-01-21T18:54:31Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![CraigFoote](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/craigfoote/32/4571_2.png) [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)\ **Post date:** [January 21, 2016, 6:54pm UTC](https://discuss.elastic.co/t/filebeat-with-multiline-vs-multiline-logstash-codec/39808/1 "2016-01-21T18:54:31Z")
I've seen some talk of a multiline option in filebeat but I'm in the process of setting up filebeat sending to logstash via beats input and need to parse multiline logs. Can I use the multiline codec in the input section for this? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [January 21, 2016, 6:57pm UTC](https://discuss.elastic.co/t/filebeat-with-multiline-vs-multiline-logstash-codec/39808/2 "2016-01-21T18:57:14Z")
Yes, but only if Filebeat only monitors a single file. I strongly suggest that you use Filebeat's multiline feature (which will be available in Filebeat 1.1, slated for release next week but you can use a nightly build or build it yourself if you don't want to wait). ---
**Author:** ![Jerry\_Hoffmeister](https://avatars.discourse-cdn.com/v4/letter/j/90ced4/32.png) [@Jerry\_Hoffmeister](https://discuss.elastic.co/u/Jerry_Hoffmeister)\ **Post date:** [February 12, 2016, 10:11pm UTC](https://discuss.elastic.co/t/filebeat-with-multiline-vs-multiline-logstash-codec/39808/3 "2016-02-12T22:11:47Z")
I stopped by to ask the same question. I have filebeat monitoring several files... is the multiline option a top level option or is / can it be per file? ---
**Author:** ![Jerry\_Hoffmeister](https://avatars.discourse-cdn.com/v4/letter/j/90ced4/32.png) [@Jerry\_Hoffmeister](https://discuss.elastic.co/u/Jerry_Hoffmeister)\ **Post date:** [February 13, 2016, 12:44am UTC](https://discuss.elastic.co/t/filebeat-with-multiline-vs-multiline-logstash-codec/39808/4 "2016-02-13T00:44:37Z")
nevermind - I've switched from the multiline filter in logstash to filebeat and it seems to be working just fine... kinda miss the grok support tho. ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [February 16, 2016, 4:43pm UTC](https://discuss.elastic.co/t/filebeat-with-multiline-vs-multiline-logstash-codec/39808/5 "2016-02-16T16:43:02Z")
regarding grok the upcoming ingest-node feature might be of interest. E.g. see elasticsearch doc from master (development?) branch: [https://www.elastic.co/guide/en/elasticsearch/reference/master/\_grok\_processor.html](https://www.elastic.co/guide/en/elasticsearch/reference/master/_grok_processor.html) filebeat's task is to collect and ship logs. Any kind of additional event processing/routing should be done by Logstash or upcoming Ingest Node in elasticsearch. ---
**Author:** ![Jerry\_Hoffmeister](https://avatars.discourse-cdn.com/v4/letter/j/90ced4/32.png) [@Jerry\_Hoffmeister](https://discuss.elastic.co/u/Jerry_Hoffmeister)\ **Post date:** [February 16, 2016, 7:24pm UTC](https://discuss.elastic.co/t/filebeat-with-multiline-vs-multiline-logstash-codec/39808/6 "2016-02-16T19:24:07Z")
One new issue I see is when using the logstash multiline filter the log line got "multiline" added to the tags array. After switching to filebeat multiline, I no longer see the tag? ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [February 16, 2016, 9:09pm UTC](https://discuss.elastic.co/t/filebeat-with-multiline-vs-multiline-logstash-codec/39808/7 "2016-02-16T21:09:39Z")
See this issue here: [https://github.com/elastic/beats/issues/957](https://github.com/elastic/beats/issues/957) ---
**Author:** ![Vedran\_Maricevic](https://avatars.discourse-cdn.com/v4/letter/v/57b2e6/32.png) [@Vedran\_Maricevic](https://discuss.elastic.co/u/Vedran_Maricevic)\ **Post date:** [May 12, 2017, 7:28am UTC](https://discuss.elastic.co/t/filebeat-with-multiline-vs-multiline-logstash-codec/39808/8 "2017-05-12T07:28:42Z")
It can be per file, in other words per prospector. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 9:49pm UTC](https://discuss.elastic.co/t/filebeat-with-multiline-vs-multiline-logstash-codec/39808/9 "2017-07-05T21:49:34Z")