# Logstash cut line why?

**URL:** <https://discuss.elastic.co/t/logstash-cut-line-why/316440>\
**Category:** Logstash\
**Created:** [October 12, 2022, 1:06pm UTC](https://discuss.elastic.co/t/logstash-cut-line-why/316440 "2022-10-12T13:06:38Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nikolas1306](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nikolas1306/32/111507_2.png) [@Nikolas1306](https://discuss.elastic.co/u/Nikolas1306)\
**Post date:** [October 12, 2022, 1:06pm UTC](https://discuss.elastic.co/t/logstash-cut-line-why/316440/1 "2022-10-12T13:06:38Z")

</div>

i have this secotion of logs

```auto
2022-09-28 16:19:49,383 ERROR [it.unidoc.cdr.core.route.Iti41MllpSource] (TcpSocketConsumerRunnable[mllp://0.0.0.0:9010] - /192.168.0.7:56372 => /192.168.0.32:9010) Conversion error: ca.uhn.hl7v2.HL7Exception: java.lang.Exception: Invalid PDF header
	at deployment.cdr-source-1.0.0.18-SNAPSHOT.war//it.unidoc.cdr.core.mllp.ProvideAndRegisterBuilder.toDocuments(ProvideAndRegisterBuilder.java:194)
	at deployment.cdr-source-1.0.0.18-SNAPSHOT.war//it.unidoc.cdr.core.mllp.ProvideAndRegisterBuilder.build(ProvideAndRegisterBuilder.java:70)
	at deployment.cdr-source-1.0.0.18-SNAPSHOT.war//it.unidoc.cdr.core.route.Iti41MllpSource.lambda$configure$2(Iti41MllpSource.java:118)
	at deployment.cdr-source-1.0.0.18-SNAPSHOT.war//it.unidoc.cdr.core.hl7v2.HL7InternalProcessor.process(HL7InternalProcessor.java:16)
	at deployment.cdr-source-1.0.0.18-SNAPSHOT.war//it.unidoc.cdr.core.hl7v2.HL7State.process(HL7State.java:100)
	at deployment.cdr-source-1.0.0.18-SNAPSHOT.war//it.unidoc.cdr.core.route.Iti41MllpSource.lambda$configure$3(Iti41MllpSource.java:104)
	at deployment.cdr-source-1.0.0.18-SNAPSHOT.war//org.apache.camel.support.processor.DelegateSyncProcessor.process(DelegateSyncProcessor.java:66)
	at deployment.cdr-source-1.0.0.18-SNAPSHOT.war//org.apache.camel.management.DefaultInstrumentationProcessor.process(DefaultInstrumentationProcessor.java:90)
	at deployment.cdr-source-1.0.0.18-SNAPSHOT.war//org.apache.camel.processor.errorhandler.RedeliveryErrorHandler$RedeliveryTask.doRun(RedeliveryErrorHandler.java:714)
	at deployment.cdr-source-1.0.0.18-SNAPSHOT.war//org.apache.camel.processor.errorhandler.RedeliveryErrorHandler$RedeliveryTask.run(RedeliveryErrorHandler.java:623)
	at deployment.cdr-source-1.0.0.18-SNAPSHOT.war//org.apache.camel.impl.engine.DefaultReactiveExecutor$Worker.schedule(DefaultReactiveExecutor.java:148)
	at deployment.cdr-source-1.0.0.18-SNAPSHOT.war//org.apache.camel.impl.engine.DefaultReactiveExecutor.scheduleMain(DefaultReactiveExecutor.java:60)
	at deployment.cdr-source-1.0.0.18-SNAPSHOT.war//org.apache.camel.processor.Pipeline.process(Pipeline.java:147)
	at deployment.cdr-source-1.0.0.18-SNAPSHOT.war//org.apache.camel.impl.engine.CamelInternalProcessor.process(CamelInternalProcessor.java:312)
	at deployment.cdr-source-1.0.0.18-SNAPSHOT.war//org.apache.camel.impl.engine.DefaultAsyncProcessorAwaitManager.process(DefaultAsyncProcessorAwaitManager.java:83)
	at deployment.cdr-source-1.0.0.18-SNAPSHOT.war//org.apache.camel.support.AsyncProcessorSupport.process(AsyncProcessorSupport.java:41)
	at deployment.cdr-source-1.0.0.18-SNAPSHOT.war//org.apache.camel.component.mllp.MllpTcpServerConsumer.processMessage(MllpTcpServerConsumer.java:273)
	at deployment.cdr-source-1.0.0.18-SNAPSHOT.war//org.apache.camel.component.mllp.internal.TcpSocketConsumerRunnable.run(TcpSocketConsumerRunnable.java:141)
	at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515)
	at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
	at java.base/java.lang.Thread.run(Thread.java:829)
Caused by: java.lang.Exception: Invalid PDF header
	at deployment.cdr-source-1.0.0.18-SNAPSHOT.war//it.unidoc.cdr.core.mllp.decoder.PdfDecoder.<init>(PdfDecoder.java:21)
	at deployment.cdr-source-1.0.0.18-SNAPSHOT.war//it.unidoc.cdr.core.mllp.decoder.DecoderFactory.fromRaw(DecoderFactory.java:20)
	at deployment.cdr-source-1.0.0.18-SNAPSHOT.war//it.unidoc.cdr.core.mllp.hl7v2.MdmDocumentConverter.convert(MdmDocumentConverter.java:173)
	at deployment.cdr-source-1.0.0.18-SNAPSHOT.war//it.unidoc.cdr.core.mllp.ProvideAndRegisterBuilder.toDocuments(ProvideAndRegisterBuilder.java:192)
	... 22 more

```

but when discover is cut by line

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/f/dfaab05ff33e0aa86523ff4958f3bcfac4997267.png)

this is cut

```auto
at deployment.cdr-source-1.0.0.18-SNAPSHOT.war//it.unidoc.cdr.core.mllp.ProvideAndRegisterBuilder.toDocuments(ProvideAndRegisterBuilder.java:194)
	at deployment.cdr-source-1.0.0.18-SNAPSHOT.war//it.unidoc.cdr.core.mllp.ProvideAndRegisterBuilder.build(ProvideAndRegisterBuilder.java:70)
	at deployment.cdr-source-1.0.0.18-SNAPSHOT.war//it.unidoc.cdr.core.route.Iti41MllpSource.lambda$configure$2(Iti41MllpSource.java:118)
	at deployment.cdr-source-1.0.0.18-SNAPSHOT.war//it.unidoc.cdr.core.hl7v2.HL7InternalProcessor.process(HL7InternalProcessor.java:16)
	at deployment.cdr-source-1.0.0.18-SNAPSHOT.war//it.unidoc.cdr.core.hl7v2.HL7State.process(HL7State.java:100)
	at deployment.cdr-source-1.0.0.18-SNAPSHOT.war//it.unidoc.cdr.core.route.Iti41MllpSource.lambda$configure$3(Iti41MllpSource.java:104)
	at deployment.cdr-source-1.0.0.18-SNAPSHOT.war//org.apache.camel.support.processor.DelegateSyncProcessor.process(DelegateSyncProcessor.java:66)
	at deployment.cdr-source-1.0.0.18-SNAPSHOT.war//org.apache.camel.management.DefaultInstrumentationProcessor.process(DefaultInstrumentationProcessor.java:90)
	at deployment.cdr-source-1.0.0.18-SNAPSHOT.war//org.apache.camel.processor.errorhandler.RedeliveryErrorHandler$RedeliveryTask.doRun(RedeliveryErrorHandler.java:714)
	at deployment.cdr-source-1.0.0.18-SNAPSHOT.war//org.apache.camel.processor.errorhandler.RedeliveryErrorHandler$RedeliveryTask.run(RedeliveryErrorHandler.java:623)
	at deployment.cdr-source-1.0.0.18-SNAPSHOT.war//org.apache.camel.impl.engine.DefaultReactiveExecutor$Worker.schedule(DefaultReactiveExecutor.java:148)
	at deployment.cdr-source-1.0.0.18-SNAPSHOT.war//org.apache.camel.impl.engine.DefaultReactiveExecutor.scheduleMain(DefaultReactiveExecutor.java:60)
	at deployment.cdr-source-1.0.0.18-SNAPSHOT.war//org.apache.camel.processor.Pipeline.process(Pipeline.java:147)
	at deployment.cdr-source-1.0.0.18-SNAPSHOT.war//org.apache.camel.impl.engine.CamelInternalProcessor.process(CamelInternalProcessor.java:312)
	at deployment.cdr-source-1.0.0.18-SNAPSHOT.war//org.apache.camel.impl.engine.DefaultAsyncProcessorAwaitManager.process(DefaultAsyncProcessorAwaitManager.java:83)
	at deployment.cdr-source-1.0.0.18-SNAPSHOT.war//org.apache.camel.support.AsyncProcessorSupport.process(AsyncProcessorSupport.java:41)
	at deployment.cdr-source-1.0.0.18-SNAPSHOT.war//org.apache.camel.component.mllp.MllpTcpServerConsumer.processMessage(MllpTcpServerConsumer.java:273)
	at deployment.cdr-source-1.0.0.18-SNAPSHOT.war//org.apache.camel.component.mllp.internal.TcpSocketConsumerRunnable.run(TcpSocketConsumerRunnable.java:141)
	at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515)
	at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
	at java.base/java.lang.Thread.run(Thread.java:829)
Caused by: java.lang.Exception: Invalid PDF header
	at deployment.cdr-source-1.0.0.18-SNAPSHOT.war//it.unidoc.cdr.core.mllp.decoder.PdfDecoder.<init>(PdfDecoder.java:21)
	at deployment.cdr-source-1.0.0.18-SNAPSHOT.war//it.unidoc.cdr.core.mllp.decoder.DecoderFactory.fromRaw(DecoderFactory.java:20)
	at deployment.cdr-source-1.0.0.18-SNAPSHOT.war//it.unidoc.cdr.core.mllp.hl7v2.MdmDocumentConverter.convert(MdmDocumentConverter.java:173)
	at deployment.cdr-source-1.0.0.18-SNAPSHOT.war//it.unidoc.cdr.core.mllp.ProvideAndRegisterBuilder.toDocuments(ProvideAndRegisterBuilder.java:192)
	... 22 more

```

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [October 12, 2022, 1:48pm UTC](https://discuss.elastic.co/t/logstash-cut-line-why/316440/2 "2022-10-12T13:48:26Z")

</div>

This is the default behavior, Logstash read the file line by line, if your log is a multline log, which is your case, you need to configure your input to use the multiline codec so your multiline logs you be sent as one log message.

How are you sending your data to logstash? You need to share your configuration.

If you are using the file input you need to configure it to use the [multiline codec](https://www.elastic.co/guide/en/logstash/current/plugins-codecs-multiline.html)

Something like this should work:

```auto
    file {
        path => "/path/to/your/log.log"
        codec => multiline {
          pattern => "^%{TIMESTAMP_ISO8601} "
          negate => true
          what => "previous"
        }

```

If you are using filebeat you need to configure it to read multiline files.

---

<div class="post-metadata">

**Author:** ![Nikolas1306](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nikolas1306/32/111507_2.png) [@Nikolas1306](https://discuss.elastic.co/u/Nikolas1306)\
**Post date:** [October 12, 2022, 2:15pm UTC](https://discuss.elastic.co/t/logstash-cut-line-why/316440/3 "2022-10-12T14:15:02Z")

</div>

hello i use this

```auto
input {
  file {

    path => ["/logstash_dir/federico2/p1/*.*"]
    
    
    start_position => "beginning"

    

     sincedb_path => "/dev/null"

  }
}

output {
 		elasticsearch {
			hosts => ["elkserver:9200"]
			index => "p1"
		}
   
		stdout { codec => rubydebug }
}

```

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [October 12, 2022, 2:16pm UTC](https://discuss.elastic.co/t/logstash-cut-line-why/316440/4 "2022-10-12T14:16:28Z")

</div>

You need to configure the multiline codec as the example you the previous answer.

Configure it and see if it solves your issue.

---

<div class="post-metadata">

**Author:** ![Nikolas1306](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nikolas1306/32/111507_2.png) [@Nikolas1306](https://discuss.elastic.co/u/Nikolas1306)\
**Post date:** [October 12, 2022, 2:51pm UTC](https://discuss.elastic.co/t/logstash-cut-line-why/316440/5 "2022-10-12T14:51:06Z")

</div>

hello now is ok ?

```auto
input {
  file {

    path => ["/logstash_dir/federico2/FSEBroker/*.*"]
    
    start_position => "beginning"

    sincedb_path => "/dev/null"

      codec => multiline {
          pattern => "^%{TIMESTAMP_ISO8601} "
          negate => true
          what => "previous"
        }

  }
}

output {
 		elasticsearch {
			hosts => ["elkserver:9200"]
			index => "fssmulti2"
		}
   
		stdout { codec => rubydebug }
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 9, 2022, 2:51pm UTC](https://discuss.elastic.co/t/logstash-cut-line-why/316440/6 "2022-11-09T14:51:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.