# How to handle multi line logs in logstash

**URL:** <https://discuss.elastic.co/t/how-to-handle-multi-line-logs-in-logstash/153609>\
**Category:** Logstash\
**Created:** [October 23, 2018, 1:23pm UTC](https://discuss.elastic.co/t/how-to-handle-multi-line-logs-in-logstash/153609 "2018-10-23T13:23:19Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Parvatayya\_Malimath](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/parvatayya_malimath/32/49330_2.png) [@Parvatayya\_Malimath](https://discuss.elastic.co/u/Parvatayya_Malimath)\
**Post date:** [October 23, 2018, 1:23pm UTC](https://discuss.elastic.co/t/how-to-handle-multi-line-logs-in-logstash/153609/1 "2018-10-23T13:23:19Z")

</div>

Hi

I have such logs, i am not sure how handle this multi line logs, as you can see. its not consistent, we have multi lines at times and single lines at times.  
please help, how to parse them

2018-10-22 15:32:24.407 DEBUG [task-detail-service-dev,9d3c34d063a7c5fe,646dff3d87b59c21,true] 13287 --- [askExecutor-438] CCMessagePublisher

2018-10-22 15:32:24.407 DEBUG [task-detail-service-dev,9d3c34d063a7c5fe,646dff3d87b59c21,true] 13287 --- [askExecutor-438] CCMessagePublisher : Publishing message some message to seome\_event\_centre:  
taskInstanceId: "111c0242-d5e7-11e8-b966-0050568b4ef6"  
eventType: "TaskVariablesUpdated"  
variables {  
key: "SOME\_KEY\_1"  
value {  
stringValue: "SOME\_VALUE\_1"  
}  
}  
variables {  
key: "SOME\_KEY\_2"  
value {  
stringValue: "SOME\_VALUE\_2"  
}  
}

I am using below conf

input { stdin { } }

filter {  
grok {  
patterns\_dir =\> ["./patterns"]  
match =\> { "message" =\> "%{WORD:log\_level} [%{GREEDYDATA:local\_address},%{POSTFIX\_QUEUEID:queue\_id},%{POSTFIX\_QUEUEID:spanId},%{WORD:random\_entry}]" }  
}

date {  
match =\> ["timestamp" , "dd/MMM/yyyy:HH:mm:ss Z"]  
}  
}

output {  
stdout { codec =\> rubydebug }  
}

---

<div class="post-metadata">

**Author:** ![londonx](https://avatars.discourse-cdn.com/v4/letter/l/da6949/32.png) [@londonx](https://discuss.elastic.co/u/londonx)\
**Post date:** [October 23, 2018, 3:49pm UTC](https://discuss.elastic.co/t/how-to-handle-multi-line-logs-in-logstash/153609/2 "2018-10-23T15:49:56Z")

</div>

use the multiline codec when importing, normally you would use the timestamp as the pattern to start a new event.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 23, 2018, 4:59pm UTC](https://discuss.elastic.co/t/how-to-handle-multi-line-logs-in-logstash/153609/3 "2018-10-23T16:59:25Z")

</div>

See [https://www.elastic.co/guide/en/logstash/current/multiline.html](https://www.elastic.co/guide/en/logstash/current/multiline.html).

---

<div class="post-metadata">

**Author:** ![Parvatayya\_Malimath](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/parvatayya_malimath/32/49330_2.png) [@Parvatayya\_Malimath](https://discuss.elastic.co/u/Parvatayya_Malimath)\
**Post date:** [October 24, 2018, 1:32pm UTC](https://discuss.elastic.co/t/how-to-handle-multi-line-logs-in-logstash/153609/4 "2018-10-24T13:32:08Z")

</div>

thanks it worked

---

<div class="post-metadata">

**Author:** ![Parvatayya\_Malimath](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/parvatayya_malimath/32/49330_2.png) [@Parvatayya\_Malimath](https://discuss.elastic.co/u/Parvatayya_Malimath)\
**Post date:** [October 24, 2018, 1:44pm UTC](https://discuss.elastic.co/t/how-to-handle-multi-line-logs-in-logstash/153609/5 "2018-10-24T13:44:16Z")

</div>

thanks a lot, it works

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 21, 2018, 1:50pm UTC](https://discuss.elastic.co/t/how-to-handle-multi-line-logs-in-logstash/153609/6 "2018-11-21T13:50:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.