# HA and Distributed Logstash with multiline codec

**URL:** <https://discuss.elastic.co/t/ha-and-distributed-logstash-with-multiline-codec/86003>\
**Category:** Logstash\
**Created:** [May 16, 2017, 7:14pm UTC](https://discuss.elastic.co/t/ha-and-distributed-logstash-with-multiline-codec/86003 "2017-05-16T19:14:27Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Willi\_Trace](https://avatars.discourse-cdn.com/v4/letter/w/bc8723/32.png) [@Willi\_Trace](https://discuss.elastic.co/u/Willi_Trace)\
**Post date:** [May 16, 2017, 7:14pm UTC](https://discuss.elastic.co/t/ha-and-distributed-logstash-with-multiline-codec/86003/1 "2017-05-16T19:14:27Z")

</div>

I am using syslog input plugin with multiline code to ingest messages from routers and Java applications (multiline mainly for Java exceptions).

I need to scale Logstash to be high available and distributed. I can build something like HAProxy between log sources and Logstash nodes to provide load balancing to all Logstash nodes.

What is not clear to me, how it will handle multiline messages like Java exceptions when it will be load balanced to different Logstash nodes?

For example one part of multiline would be sent to Logstash Node 1 and second part of multiline message would be sent to Logstash Node 2. How it will be handled?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 18, 2017, 5:32am UTC](https://discuss.elastic.co/t/ha-and-distributed-logstash-with-multiline-codec/86003/2 "2017-05-18T05:32:44Z")

</div>

> What is not clear to me, how it will handle multiline messages like Java exceptions when it will be load balanced to different Logstash nodes?

It won't. Relying on a multiline codec for a syslog input sounds like a bad idea in general. Even with a single Logstash instance, is there any guarantee that messages from different hosts won't interleave?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 15, 2017, 5:32am UTC](https://discuss.elastic.co/t/ha-and-distributed-logstash-with-multiline-codec/86003/3 "2017-06-15T05:32:56Z")

</div>

Closed on June 15, 2017, 5:32am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.