# How to configure GREDDYDATA in logstash to take mutiline input

**URL:** <https://discuss.elastic.co/t/how-to-configure-greddydata-in-logstash-to-take-mutiline-input/272046>\
**Category:** Logstash\
**Created:** [May 4, 2021, 7:46am UTC](https://discuss.elastic.co/t/how-to-configure-greddydata-in-logstash-to-take-mutiline-input/272046 "2021-05-04T07:46:33Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Learn\_Mulesoft\_With](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/learn_mulesoft_with/32/87561_2.png) [@Learn\_Mulesoft\_With](https://discuss.elastic.co/u/Learn_Mulesoft_With)\
**Post date:** [May 4, 2021, 7:46am UTC](https://discuss.elastic.co/t/how-to-configure-greddydata-in-logstash-to-take-mutiline-input/272046/1 "2021-05-04T07:46:33Z")

</div>

INFO 2021-04-17 21:40:25,689 [[MuleRuntime].uber.01: [testproject].testprojectFlow.CPU\_LITE @4d779882] [processor: testprojectFlow/processors/0; event: 6b78a980-9f97-11eb-a8e6-f8ac6500be0e] org.mule.runtime.core.internal.processor.LoggerMessageProcessor: logger success

for this payload i can parse it correctly.

but problem is for below payload:

ERROR 2021-05-04 12:51:13,698 [[MuleRuntime].uber.08: [publishtosocketandlogstash].publishtosocketandlogstashFlow.CPU\_LITE @399d2dad] [processor: publishtosocketandlogstashFlow/processors/0; event: 4ddc3620-aca9-11eb-8d01-f8ac6500be0e] org.mule.runtime.core.internal.exception.OnErrorPropagateHandler:

* * *

Message : "You called the function '/' with these arguments:  
1: String ("first logger")  
2: Number (0)

But it expects arguments of these types:  
1: Number  
2: Number

1| payload ++ "first logger"/0  
^^^^^^^^^^^^^^^^  
Trace:  
at ++ (line: 1, column: 13)  
at main (line: 1, column: 10)" evaluating expression: "payload ++ "first logger"/0".  
Element : publishtosocketandlogstashFlow/processors/0 @ publishtosocketandlogstash:publishtosocketandlogstash.xml:27 (Logger)  
Element DSL : \<logger level="INFO" doc:name="Logger" doc:id="e117b70a-e93f-40ab-ac14-913ec8460c77" message="#[payload ++ "first logger"/0]"\>  
Error type : MULE:EXPRESSION  
FlowStack : at publishtosocketandlogstashFlow(publishtosocketandlogstashFlow/processors/0 @ publishtosocketandlogstash:publishtosocketandlogstash.xml:27 (Logger))

and my grok filter is  
%{LOGLEVEL:log-level}\s\*%{TIMESTAMP\_ISO8601:logdate} [%{DATA:runtime}] [%{DATA:processor}; %{WORD:d}:%{DATA:correlationID}]%{DATA:class}:%{GREEDYDATA:message}

how should i take multiline data using GREEDYDATA

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 1, 2021, 7:46am UTC](https://discuss.elastic.co/t/how-to-configure-greddydata-in-logstash-to-take-mutiline-input/272046/2 "2021-06-01T07:46:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
