# Logstash file input W/ multiline cuts text

**URL:** <https://discuss.elastic.co/t/logstash-file-input-w-multiline-cuts-text/157373>\
**Category:** Logstash\
**Created:** [November 19, 2018, 2:00pm UTC](https://discuss.elastic.co/t/logstash-file-input-w-multiline-cuts-text/157373 "2018-11-19T14:00:57Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![urirosenberg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/urirosenberg/32/38326_2.png) [@urirosenberg](https://discuss.elastic.co/u/urirosenberg)\
**Post date:** [November 19, 2018, 2:00pm UTC](https://discuss.elastic.co/t/logstash-file-input-w-multiline-cuts-text/157373/1 "2018-11-19T14:00:57Z")

</div>

Hi,  
We are using logstash for ingesting files from a file system.  
The problem we started to observe is that the input/content is being cut (so LS is indexing 2 events for certain files).

Here's a sample of our input config:  
file {  
path =\> "/dropzone/app/myfiiles/_"  
exclude =\> ["_.lz4", "data/_", "_.csv", "_.tbl"]  
start\_position =\> "beginning"  
ignore\_older =\> 0  
max\_open\_files =\> 1000  
sincedb\_path =\> "/dev/null"  
close\_older =\> 2  
add\_field =\> { "type" =\> "mytype"}  
add\_field =\> { "[@metadata][event\_type]" =\> "mytype"}  
codec =\> multiline {  
pattern =\> "/._./gm"  
negate =\> true  
what =\> previous  
max\_lines =\> 3000000  
max\_bytes =\> "120MiB"  
auto\_flush\_interval =\> 5  
charset =\> "ASCII"  
}

more info:

1. The files being split/cut differ each day (not the same files).
2. The files DON'T contain special characters nor does LS outputs any errors in the logs
3. we are running multiple LS as docker containers (each with it's own pipeline)
4. Using LS 5.4

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 17, 2018, 2:01pm UTC](https://discuss.elastic.co/t/logstash-file-input-w-multiline-cuts-text/157373/2 "2018-12-17T14:01:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.