# Get lines in one line logstash filter
**URL:** https://discuss.elastic.co/t/get-lines-in-one-line-logstash-filter/297263
**Category:** Logstash
**Created:** [February 15, 2022, 3:06pm UTC](https://discuss.elastic.co/t/get-lines-in-one-line-logstash-filter/297263 "2022-02-15T15:06:45Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@alex\_vermex](https://discuss.elastic.co/u/alex_vermex)
#### Post date: [February 15, 2022, 3:06pm UTC](https://discuss.elastic.co/t/get-lines-in-one-line-logstash-filter/297263/1 "2022-02-15T15:06:45Z")
Hi,
log file example:
```auto
0101-15:17:39:012|aze|exp|id|aa|bb|ee|rr|zz|tt|jj
0101-15:17:39:012|aze|exp|id....|ERR exception
nom du para: sss
à System...
à Web.............|Ref|lev|15|Code_Status = 50
0101-15:17:39:012|aze|exp|id|aa|bb|ee|rr|zz|tt|jj
```
the problem is that logstash reads the file line by line so it added a message with "para name:sss"...
can logstash keep some lines on a single line or create those lines in a single message?
About multiline, sometimes I have log files that don't contain "ERR exception".
So I don't know if there is a solution for this 😕
Any help would be sincerely appreciate!
Thanks!
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [February 15, 2022, 5:02pm UTC](https://discuss.elastic.co/t/get-lines-in-one-line-logstash-filter/297263/2 "2022-02-15T17:02:51Z")
You can use a [multiline](https://www.elastic.co/guide/en/logstash/current/plugins-codecs-multiline.html) codec. Perhaps
```
codec => multiline {
pattern => "^\d{4}-\d{2}:\d{2}:\d{2}:\d{3}"
negate => true
what => previous
auto_flush_interval => 5
}
```
That would join the "nom du para" line and the two after it to the "ERR exception" line.
---
### Author:  [@alex\_vermex](https://discuss.elastic.co/u/alex_vermex)
#### Post date: [February 16, 2022, 9:56am UTC](https://discuss.elastic.co/t/get-lines-in-one-line-logstash-filter/297263/3 "2022-02-16T09:56:36Z")
Thank you so much for the reply it works,
Just one more question when i have beats file in input the multiline didnt work under beats { } in logstash ?
I mean like this:
```auto
input {
beats {
port => "5044"
codec => multiline {
pattern => "^\d{4}-\d{2}:\d{2}:\d{2}:\d{3}"
negate => true
what => previous
auto_flush_interval => 5
}
}
}
```
Well i solve it with a config in filebeat.yml:
```auto
multiline.type: pattern
multiline.pattern: '^\d{4}-\d{2}:\d{2}:\d{2}:\d{3}'
multiline.negate: true
multiline.match: after
multiline.max_lines: 5
```
Thanks.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [February 16, 2022, 6:32pm UTC](https://discuss.elastic.co/t/get-lines-in-one-line-logstash-filter/297263/4 "2022-02-16T18:32:32Z")
Indeed, as the [documentation](https://www.elastic.co/guide/en/logstash/current/plugins-codecs-multiline.html#_description_183) notes, you should not use a multiline codec with a beats input because it might combine lines from multiple senders. Do it in the beat instead.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 16, 2022, 6:33pm UTC](https://discuss.elastic.co/t/get-lines-in-one-line-logstash-filter/297263/5 "2022-03-16T18:33:30Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.