# Logstash codecs (multiline,json) uncomplete messages from file lines

**URL:** <https://discuss.elastic.co/t/logstash-codecs-multiline-json-uncomplete-messages-from-file-lines/115286>\
**Category:** Logstash\
**Created:** [January 12, 2018, 11:56am UTC](https://discuss.elastic.co/t/logstash-codecs-multiline-json-uncomplete-messages-from-file-lines/115286 "2018-01-12T11:56:10Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![Ged](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ged/32/65761_2.png) [@Ged](https://discuss.elastic.co/u/Ged)\
**Post date:** [January 16, 2018, 5:05pm UTC](https://discuss.elastic.co/t/logstash-codecs-multiline-json-uncomplete-messages-from-file-lines/115286/3 "2018-01-16T17:05:49Z")

</div>

logstash-codec-json works expects single JSON messages, so i need to extract them first when reading file containing JSON lines (JSON messages delimited by \n) using logstash-codec-multiline plugin.

It works in most cases but problem occurs in about 0,3% of all processed log lines.

Both strings from example in my previous post apply to single log line:

- first is just a single line from log file
- second is related "message" value.

As you can see beginning of data in "message" value is missing comparing to log line. I mean that part:  
{"Validation::Ms":1,"Authentication::Ms":4,"Profile::XId::FindProfile::Ms":2,"SearchQuery::

I've marked difference in bold in first post.

Do you think it's multiline problem ?

I've suggested NFS after reading this:  
[https://discuss.elastic.co/t/logstash-vs-nfs-null-characters/25918](https://discuss.elastic.co/t/logstash-vs-nfs-null-characters/25918)

Thanks !

---

_[View the full topic](https://discuss.elastic.co/t/logstash-codecs-multiline-json-uncomplete-messages-from-file-lines/115286)._