# Logstash conf multiline management

**URL:** <https://discuss.elastic.co/t/logstash-conf-multiline-management/1321>\
**Category:** Logstash\
**Created:** [May 26, 2015, 2:33pm UTC](https://discuss.elastic.co/t/logstash-conf-multiline-management/1321 "2015-05-26T14:33:45Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tibo](https://avatars.discourse-cdn.com/v4/letter/t/439d5e/32.png) [@Tibo](https://discuss.elastic.co/u/Tibo)\
**Post date:** [May 26, 2015, 2:33pm UTC](https://discuss.elastic.co/t/logstash-conf-multiline-management/1321/1 "2015-05-26T14:33:45Z")

</div>

Hi,

I have a log file in input to logstash, something like that :  
[....]  
2015-04-08 00:21:21,248 [11] INFO Traitement de l'archive 20150313.tar-gz  
2015-04-08 00:21:21,248 [11] INFO Extraction de l'archive 20150313.tar-gz  
2015-04-08 00:21:57,513 [11] INFO Fin de l'extraction de l'archive  
[....]

I already have an elapsed filter to calculate the processing time between the "Traitement" line and the "Fin de l'archive" one.  
But I'd also like to index with the last line the name of the tar-gz file (here "20150313"). The issue is I need to get it from previous line.

Any help will be appreciated. Thanks

---

<div class="post-metadata">

**Author:** ![rafaltrojniak](https://avatars.discourse-cdn.com/v4/letter/r/ecc23a/32.png) [@rafaltrojniak](https://discuss.elastic.co/u/rafaltrojniak)\
**Post date:** [May 26, 2015, 8:34pm UTC](https://discuss.elastic.co/t/logstash-conf-multiline-management/1321/2 "2015-05-26T20:34:29Z")

</div>

Hello Tibo,

Your problem was quite interesting, so doing some research work I used it.

The problem is : When the end event is processed, the beginning event processing is already finished. There is no direct way to access it.

The only idea on how to walk-around that from my POV is :

- Simply add this information to final event on event generator side (application/script)
- Use Multiline and connect both events into one.  
The last way Proof Of Concept I had implemented on my githab tibo\_case branch. If you would like to still have the separate events, you would have to duplicate the events.

Rules :

> <https://github.com/rafaltrojniak/logstash_rules/blob/tibo_case/rules/tibo.conf>

  
Doc :  

> <https://github.com/rafaltrojniak/logstash_rules/blob/tibo_case/doc.md>

Hope that helps

Regards,

---

<div class="post-metadata">

**Author:** ![Tibo](https://avatars.discourse-cdn.com/v4/letter/t/439d5e/32.png) [@Tibo](https://discuss.elastic.co/u/Tibo)\
**Post date:** [May 27, 2015, 8:03am UTC](https://discuss.elastic.co/t/logstash-conf-multiline-management/1321/3 "2015-05-27T08:03:35Z")

</div>

Thanks a lot, exactly what I needed.

Regards

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:39am UTC](https://discuss.elastic.co/t/logstash-conf-multiline-management/1321/4 "2017-07-06T05:39:14Z")

</div>