# Logstash Filter Verifier - Multiline Messages

**URL:** <https://discuss.elastic.co/t/logstash-filter-verifier-multiline-messages/84463>\
**Category:** Logstash\
**Created:** [May 3, 2017, 9:19pm UTC](https://discuss.elastic.co/t/logstash-filter-verifier-multiline-messages/84463 "2017-05-03T21:19:10Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![dawi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dawi/32/2439_2.png) [@dawi](https://discuss.elastic.co/u/dawi)\
**Post date:** [May 3, 2017, 9:19pm UTC](https://discuss.elastic.co/t/logstash-filter-verifier-multiline-messages/84463/1 "2017-05-03T21:19:10Z")

</div>

Logstash Filter Verifier works great for testing even complex Logstash Pipelines.

However it seems that it currently does not support testing of multiline messages properly.

Whenever I add a "\n" into the message string, it will increase the number of events, which will cause the tests to fail like this:

> Testcase failed, continuing with the rest: Expected 3 event(s), got 5 instead.

How can I test multiline messages (eg. messages including Java StackTraces) via Logstash Filter Verifier?

@magnusbaeck 1. Is this currently possible? 2. Thanks for this great convenient tool. 🙂

---

<div class="post-metadata">

**Author:** ![dawi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dawi/32/2439_2.png) [@dawi](https://discuss.elastic.co/u/dawi)\
**Post date:** [May 7, 2017, 7:26pm UTC](https://discuss.elastic.co/t/logstash-filter-verifier-multiline-messages/84463/2 "2017-05-07T19:26:08Z")

</div>

Ok, i figured out that it is perfectly possible to test multiline messages with logstash filter verifier.  
To do so, the codec json has to be used instead of line or json\_line.

One thing that drove me crazy is that if you use the --sockets flag (what you very likely want to speed up the tests) you cannot have more than one multiline test case per test file.

In this case you currently have two options:

1. Don't use the --sockets flag (which will result in slow tests)
2. Put each multiline test case in a separate file.

**Maybe I should make a bugreport, but I am not sure if it is a bug or intended behaviour.**

---

<div class="post-metadata">

**Author:** ![antoinepourriot](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/antoinepourriot/32/10501_2.png) [@antoinepourriot](https://discuss.elastic.co/u/antoinepourriot)\
**Post date:** [May 30, 2017, 12:28pm UTC](https://discuss.elastic.co/t/logstash-filter-verifier-multiline-messages/84463/3 "2017-05-30T12:28:22Z")

</div>

Hi @dawi

i struggle to test multiline events. Could you please share a sample test file ?

mine is:  
"codec": "json",  
"input": [  
"{"message": "13:59:17,601 WARN [org.apache.cxf.phase.PhaseInterceptorChain] Interceptor for {[http://proofofidentity.documents.fr/](http://proofofidentity.documents.fr/)}ProofOfIdentityWebService has thrown exception, unwinding now\nmiddleware.exceptions.TechnicalException: Some constraints\n\t The field value has value \n\n\tat java.lang.Thread.run(Thread.java:745)"}"  
],

ouput is :  
Testcase failed, continuing with the rest: Expected 1 event(s), got XX instead.

---

<div class="post-metadata">

**Author:** ![dawi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dawi/32/2439_2.png) [@dawi](https://discuss.elastic.co/u/dawi)\
**Post date:** [May 30, 2017, 1:19pm UTC](https://discuss.elastic.co/t/logstash-filter-verifier-multiline-messages/84463/4 "2017-05-30T13:19:18Z")

</div>

Hi, Antoine. You should not be using the json codec. Testing Multiline Messages works fine with the json\_lines codec. See [multiple multiline messages testcases don't work with --sockets flag · Issue #39 · magnusbaeck/logstash-filter-verifier · GitHub](https://github.com/magnusbaeck/logstash-filter-verifier/issues/39) for more information.

Note that you have to double escape the linebreaks. Example:

> "{"message":"line 1\\nline 2\\nline 3"}"

---

<div class="post-metadata">

**Author:** ![antoinepourriot](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/antoinepourriot/32/10501_2.png) [@antoinepourriot](https://discuss.elastic.co/u/antoinepourriot)\
**Post date:** [May 30, 2017, 3:28pm UTC](https://discuss.elastic.co/t/logstash-filter-verifier-multiline-messages/84463/5 "2017-05-30T15:28:18Z")

</div>

@dawi thanks a lot !

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 27, 2017, 3:28pm UTC](https://discuss.elastic.co/t/logstash-filter-verifier-multiline-messages/84463/6 "2017-06-27T15:28:22Z")

</div>

Closed on June 27, 2017, 3:28pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.