# Final multiline event not processed

**URL:** https://discuss.elastic.co/t/final-multiline-event-not-processed/54887
**Category:** Logstash
**Created:** [July 7, 2016, 3:15am UTC](https://discuss.elastic.co/t/final-multiline-event-not-processed/54887 "2016-07-07T03:15:38Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![leifmadsen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leifmadsen/32/10749_2.png) [@leifmadsen](https://discuss.elastic.co/u/leifmadsen)
#### Post date: [July 7, 2016, 3:15am UTC](https://discuss.elastic.co/t/final-multiline-event-not-processed/54887/1 "2016-07-07T03:15:38Z")

</div>

So I'm using the multiline codec, and it seems to be working great. However, I'm doing filtering on the FileBeats side so that I'm only sending the multiline values that I expect to parse on the other end.

(I can't use the multiline parsing on FileBeat, because the include\_filter is done after the multiline is processed, which is too bad, or I'd do all my processing on the client side.)

What I'm running into, is that the final set of events isn't processed (flushed? I'm new to Logstash terminology), as no additional event is sent over.

Is there a way to tell Logstash via Beats that all events have been sent, and to flush the buffer? Or is the proper way to solve this via the auto\_flush\_interval setting in the multiline codec configuration?

**Edit** : Seems the answer is, as I somewhat figured, was to add an `auto_flush` option: [https://github.com/elastic/logstash/issues/4567](https://github.com/elastic/logstash/issues/4567)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:49am UTC](https://discuss.elastic.co/t/final-multiline-event-not-processed/54887/2 "2017-07-06T04:49:08Z")

</div>


