# Help with Multiline

**URL:** <https://discuss.elastic.co/t/help-with-multiline/63479>\
**Category:** Logstash\
**Created:** [October 20, 2016, 7:55am UTC](https://discuss.elastic.co/t/help-with-multiline/63479 "2016-10-20T07:55:20Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![debarun](https://avatars.discourse-cdn.com/v4/letter/d/a88e4f/32.png) [@debarun](https://discuss.elastic.co/u/debarun)\
**Post date:** [October 20, 2016, 7:55am UTC](https://discuss.elastic.co/t/help-with-multiline/63479/1 "2016-10-20T07:55:20Z")

</div>

Hi ,

I just came across an event where the log lines are of the format:

> 1. 
> 
> Date:2016-10-18  
> Time:14:31:05  
> Event Code:0x60a  
> Description:Internal information only. A logical unit has been enabled  
> Subsystem:CKM00124801986  
> Device:Bus 1 Enclosure 4 Disk 10  
> SP:SPA  
> Host:localhost  
> Source:N/A  
> Category:N/A  
> Log:Storage Array  
> Sense Key:0x0  
> Ext Code1:0x1cb01c4  
> Ext Code2:0x1e57140a  
> Type:Information

But i just cant get the multiline to work for this.

I tried:-  
%{NUMBER}.\nDate:%{DATE\_YMD}

Please help.

---

<div class="post-metadata">

**Author:** ![debarun](https://avatars.discourse-cdn.com/v4/letter/d/a88e4f/32.png) [@debarun](https://discuss.elastic.co/u/debarun)\
**Post date:** [October 21, 2016, 9:47am UTC](https://discuss.elastic.co/t/help-with-multiline/63479/2 "2016-10-21T09:47:29Z")

</div>

Hi,

Any help is appreciated.

Regards,  
Debarun.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 23, 2016, 4:54pm UTC](https://discuss.elastic.co/t/help-with-multiline/63479/3 "2016-10-23T16:54:12Z")

</div>

Is "1." the indicator that a new message begins? If so,

```nohighlight
pattern => "^1\.$"
negate => true
what => previous

```

should work, i.e. "unless the line begins with '1.', join it with the previous line".

---

<div class="post-metadata">

**Author:** ![debarun](https://avatars.discourse-cdn.com/v4/letter/d/a88e4f/32.png) [@debarun](https://discuss.elastic.co/u/debarun)\
**Post date:** [October 24, 2016, 7:21am UTC](https://discuss.elastic.co/t/help-with-multiline/63479/4 "2016-10-24T07:21:15Z")

</div>

HI,

The loglines progress as **1.** then **2.** , **3.** and so on.

Regards,  
Debarun.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 24, 2016, 10:41am UTC](https://discuss.elastic.co/t/help-with-multiline/63479/5 "2016-10-24T10:41:40Z")

</div>

Okay, so use `^\d+\.$` then.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:33am UTC](https://discuss.elastic.co/t/help-with-multiline/63479/6 "2017-07-06T04:33:04Z")

</div>