# Hi All, Please help to resolve this issue. Due to line break after "Command Line : test" in the log data is not coming to single object

**URL:** <https://discuss.elastic.co/t/hi-all-please-help-to-resolve-this-issue-due-to-line-break-after-command-line-test-in-the-log-data-is-not-coming-to-single-object/199293>\
**Category:** Logstash\
**Created:** [September 12, 2019, 4:52pm UTC](https://discuss.elastic.co/t/hi-all-please-help-to-resolve-this-issue-due-to-line-break-after-command-line-test-in-the-log-data-is-not-coming-to-single-object/199293 "2019-09-12T16:52:58Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![praveena77](https://avatars.discourse-cdn.com/v4/letter/p/6de8d8/32.png) [@praveena77](https://discuss.elastic.co/u/praveena77)\
**Post date:** [September 12, 2019, 4:52pm UTC](https://discuss.elastic.co/t/hi-all-please-help-to-resolve-this-issue-due-to-line-break-after-command-line-test-in-the-log-data-is-not-coming-to-single-object/199293/1 "2019-09-12T16:52:58Z")

</div>

log data

Job Id : 181202632  
Job Name : yutrw  
Batch Id : 181202632  
Command Line : test

Execution User : WINNTDOM  
Execution Queue : General

output  
{  
Job Name : yutrw  
Batch Id : 181202632  
Command Line : test  
}  
{  
Execution User : WINNTDOM  
Execution Queue : General  
}

expecting like single object  
{  
Job Name : yutrw  
Batch Id : 181202632  
Command Line : test  
Execution User : WINNTDOM  
Execution Queue : General  
}

Logstash configuration

input {  
file {  
path =\> "/logstash/data/test.log"   
start\_position =\> "beginning"  
sincedb\_path =\> "nul"  
codec =\> multiline {  
pattern =\> "^\s"  
negate =\> true  
what =\> "previous"  
}  
}  
}

filter {  
if ":" not in [message] or "\*" in [message] or "Note" in [message]  
{  
drop{}  
}  
mutate{  
gsub=\>["message","\r",""]  
}  
grok{  
match=\>{"message"=\>{ %{GREEDYDATA:errordetails}"}}  
}  
kv {  
field\_split =\> "\n"  
value\_split =\> ":"  
source =\> "message"  
}  
mutate {  
remove\_field =\> ["message"]  
}

mutate {  
remove\_tag =\> ["multiline"]  
}

mutate {  
remove\_field =\> ["tags"]  
}

mutate {  
remove\_field =\> ["@version"]  
}  
}

output {  
elasticsearch { hosts =\> ["localhost:9200"]  
index =\> "ActiveBatchLog"  
document\_type =\> "ActiveBatchLog"  
}  
stdout { codec =\> rubydebug }  
}

REs

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [September 14, 2019, 10:22am UTC](https://discuss.elastic.co/t/hi-all-please-help-to-resolve-this-issue-due-to-line-break-after-command-line-test-in-the-log-data-is-not-coming-to-single-object/199293/2 "2019-09-14T10:22:37Z")

</div>

It looks like you have an empty line that causes the multi line codec to trigger. How do you differentiate between the two empty lines? What does a larger sample of the log looks like?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 12, 2019, 10:22am UTC](https://discuss.elastic.co/t/hi-all-please-help-to-resolve-this-issue-due-to-line-break-after-command-line-test-in-the-log-data-is-not-coming-to-single-object/199293/3 "2019-10-12T10:22:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.