# How to update the multiline log

**URL:** <https://discuss.elastic.co/t/how-to-update-the-multiline-log/106827>\
**Category:** Logstash\
**Created:** [November 8, 2017, 9:23am UTC](https://discuss.elastic.co/t/how-to-update-the-multiline-log/106827 "2017-11-08T09:23:18Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![admanheart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/admanheart/32/23946_2.png) [@admanheart](https://discuss.elastic.co/u/admanheart)\
**Post date:** [November 8, 2017, 9:23am UTC](https://discuss.elastic.co/t/how-to-update-the-multiline-log/106827/1 "2017-11-08T09:23:18Z")

</div>

hi guys：  
i have a log like this :  
2017-11-08T16:40:40Z 192.168.1.1 logbody\nlogbody\nlogbody  
i want to filter this log by \n, and each message field had a field name source\_ip:192.168.1.1 ，how can i do with the filter?  
english is no my first language, if what i mean isnot clear,please tell me.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 6, 2017, 9:23am UTC](https://discuss.elastic.co/t/how-to-update-the-multiline-log/106827/2 "2017-12-06T09:23:24Z")

</div>

Closed on December 6, 2017, 9:23am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.