# Is Logstash beats input with multiline codec allowed or not?
**URL:** https://discuss.elastic.co/t/is-logstash-beats-input-with-multiline-codec-allowed-or-not/287230
**Category:** Logstash
**Created:** [October 20, 2021, 7:04pm UTC](https://discuss.elastic.co/t/is-logstash-beats-input-with-multiline-codec-allowed-or-not/287230 "2021-10-20T19:04:55Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Rodrigo\_Jimenez](https://discuss.elastic.co/u/Rodrigo_Jimenez)
#### Post date: [October 20, 2021, 7:04pm UTC](https://discuss.elastic.co/t/is-logstash-beats-input-with-multiline-codec-allowed-or-not/287230/1 "2021-10-20T19:04:55Z")
I know some of this might have been asked here before but Documentation and logs express differently.
I want to fetch logs from AWS Cloudwatch. For that, i'm using filebeat's input. This input is not doing any kind of multiline processing (this is not clear from the documentation either)
Since I can't do multiline "as close to the source as possible" I wanted to do it in Logstash. So I had a beats input with a multiline codec. But Logstash complains:
```auto
[ERROR] 2021-10-20 15:54:43.842 [[multilined-input]-pipeline-manager] beats - Multiline codec with beats input is not supported. Please refer to the beats documentation for how to best manage multiline data. See https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html
[INFO] 2021-10-20 15:54:43.848 [[main]-pipeline-manager] javapipeline - Pipeline started {"pipeline.id"=>"main"}
[ERROR] 2021-10-20 15:54:43.967 [[multilined-input]-pipeline-manager] javapipeline - Pipeline error {:pipeline_id=>"multilined-input", :exception=># If you are using a Logstash input plugin that supports multiple hosts, such as the [beats input plugin](https://www.elastic.co/guide/en/logstash/7.15/plugins-inputs-beats.html), you should not use the multiline codec to handle multiline events. Doing so may result in the mixing of streams and corrupted event data. In this situation, you need to handle multiline events before sending the event data to Logstash.
> **[Multiline codec plugin | Logstash Reference \[8.11\] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-codecs-multiline.html)**
I tried creating a single worker pipeline dedicated for this in order to prevent the mixing of streams but I can't get it to even start.
So, is it possible but not recommended, or not possible at all?
thanks!
Rodrigo.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [October 20, 2021, 7:09pm UTC](https://discuss.elastic.co/t/is-logstash-beats-input-with-multiline-codec-allowed-or-not/287230/2 "2021-10-20T19:09:04Z")
> [@Rodrigo\_Jimenez](#):
>
> So, is it possible but not recommended, or not possible at all?
Not possible. The input will [raise an exception](https://github.com/logstash-plugins/logstash-input-beats/blob/b9953b64f13e0f9502e02734f08c5a92146ba03e/lib/logstash/inputs/beats.rb#L165) if you configure the codec to be multiline.
---
### Author:  [@Rodrigo\_Jimenez](https://discuss.elastic.co/u/Rodrigo_Jimenez)
#### Post date: [October 21, 2021, 11:55am UTC](https://discuss.elastic.co/t/is-logstash-beats-input-with-multiline-codec-allowed-or-not/287230/3 "2021-10-21T11:55:33Z")
Thanks! At least I know I could try running a 5.x version of logstash in a docker container
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 18, 2021, 11:56am UTC](https://discuss.elastic.co/t/is-logstash-beats-input-with-multiline-codec-allowed-or-not/287230/4 "2021-11-18T11:56:32Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.