# How to deal with different log in input?

**URL:** https://discuss.elastic.co/t/how-to-deal-with-different-log-in-input/52146
**Category:** Logstash
**Created:** [June 8, 2016, 3:32am UTC](https://discuss.elastic.co/t/how-to-deal-with-different-log-in-input/52146 "2016-06-08T03:32:55Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![WangXiangUSTC](https://avatars.discourse-cdn.com/v4/letter/w/8dc957/32.png) [@WangXiangUSTC](https://discuss.elastic.co/u/WangXiangUSTC)
#### Post date: [June 8, 2016, 3:32am UTC](https://discuss.elastic.co/t/how-to-deal-with-different-log-in-input/52146/1 "2016-06-08T03:32:55Z")

</div>

I have a lot of logs to deal,they have different format. For example, some are one log with one line, but some are one log with several lines.

First I use multiline in filter, but the logstash show: Defaulting pipeline worker threads to 1 because there are some filters that might not work with multiple worker threads {:count\_was=\>32, :filters=\>["multiline", "multiline"], :level=\>:warn}

the logstash's efficiency is very low.

then,I config like this:  
1 input {  
2 beats {  
3 port =\> 5044  
4 }  
5  
6 if "test1.log" in [source] {  
7 codec =\> multiline {  
8 pattern =\> "^\s"  
9 what =\> "previous"  
10 }  
11 }  
12 }  
but the config is wrong.

I want to use codec multiline only on test1.log, and I want to use only a beat port, how to config?

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [June 9, 2016, 12:13am UTC](https://discuss.elastic.co/t/how-to-deal-with-different-log-in-input/52146/2 "2016-06-09T00:13:30Z")

</div>

You cannot use conditionals in inputs.  
Look at leveraging filebeat with it's multiline capabilities.

---

<div class="post-metadata">

### Author: ![WangXiangUSTC](https://avatars.discourse-cdn.com/v4/letter/w/8dc957/32.png) [@WangXiangUSTC](https://discuss.elastic.co/u/WangXiangUSTC)
#### Post date: [June 10, 2016, 12:12pm UTC](https://discuss.elastic.co/t/how-to-deal-with-different-log-in-input/52146/3 "2016-06-10T12:12:45Z")

</div>

ok, thanks for your reply

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:53am UTC](https://discuss.elastic.co/t/how-to-deal-with-different-log-in-input/52146/4 "2017-07-06T04:53:38Z")

</div>


