# Logging Multiline events using logforwarder and log stash

**URL:** <https://discuss.elastic.co/t/logging-multiline-events-using-logforwarder-and-log-stash/28455>\
**Category:** Logstash\
**Created:** [September 1, 2015, 5:55pm UTC](https://discuss.elastic.co/t/logging-multiline-events-using-logforwarder-and-log-stash/28455 "2015-09-01T17:55:40Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![vgupta](https://avatars.discourse-cdn.com/v4/letter/v/67e7ee/32.png) [@vgupta](https://discuss.elastic.co/u/vgupta)\
**Post date:** [September 1, 2015, 5:55pm UTC](https://discuss.elastic.co/t/logging-multiline-events-using-logforwarder-and-log-stash/28455/1 "2015-09-01T17:55:40Z")

</div>

Hi

I want to transfer Java logs using log forwarder on the application servers.

What will be the best way to log Java exceptions as single event as log-forwarder doesn't support Multiline input codec?

Can I use "Multiline Filter" in the logstash that will receive events from logforwarder to treat them as a single event and associate them with the timestamp received in the previous event?

Thanks

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 1, 2015, 5:58pm UTC](https://discuss.elastic.co/t/logging-multiline-events-using-logforwarder-and-log-stash/28455/2 "2015-09-01T17:58:33Z")

</div>

Yes, you can use the multiline filter for this. You'll want to make sure the [`stream_identity` parameter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-multiline.html#plugins-filters-multiline-stream_identity) is correctly set to a value that allows the filter to pair up the different streams of log data and concatenate lines that go together. The default value will probably do.

---

<div class="post-metadata">

**Author:** ![vgupta](https://avatars.discourse-cdn.com/v4/letter/v/67e7ee/32.png) [@vgupta](https://discuss.elastic.co/u/vgupta)\
**Post date:** [September 1, 2015, 6:01pm UTC](https://discuss.elastic.co/t/logging-multiline-events-using-logforwarder-and-log-stash/28455/3 "2015-09-01T18:01:19Z")

</div>

Thanks. That was quick.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:30am UTC](https://discuss.elastic.co/t/logging-multiline-events-using-logforwarder-and-log-stash/28455/4 "2017-07-06T05:30:31Z")

</div>