# Logstash Log file creation

**URL:** <https://discuss.elastic.co/t/logstash-log-file-creation/134602>\
**Category:** Logstash\
**Created:** [June 5, 2018, 11:35am UTC](https://discuss.elastic.co/t/logstash-log-file-creation/134602 "2018-06-05T11:35:35Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![amritesh\_mishra](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amritesh_mishra/32/50251_2.png) [@amritesh\_mishra](https://discuss.elastic.co/u/amritesh_mishra)\
**Post date:** [June 5, 2018, 11:35am UTC](https://discuss.elastic.co/t/logstash-log-file-creation/134602/1 "2018-06-05T11:35:35Z")

</div>

In the config file when are trying to read the log file in the log file there are multiline log information is there how can we handle that.  
Below is the log file i am giving you .  
05 Jun 2018 12:20:59,171 | WARN | TalendMP1555Prod | rg.apache.camel.util.CamelLogger 182 | 161 - org.apache.camel.camel-core - 2.15.4 | A20180605.1200+0100-1215+0100  
\_73847.xml.gz  
05 Jun 2018 12:20:59,208 | WARN | TalendMP1555Prod | rg.apache.camel.util.CamelLogger 182 | 161 - org.apache.camel.camel-core - 2.15.4 | A20180605.1200+0100-1215+0100  
\_64687.xml.gz  
**05 Jun 2018 12:20:59,218 | WARN | onfig/MP1451\_ANM | rg.apache.camel.util.CamelLogger 161 | 164 - org.apache.camel.camel-ftp - 2.15.4 | Cannot acquire read lock withi**  
**n 20000 millis. Will skip the file: RemoteFile[/home/tmukftp/config/MP1451\_ANM/OMCR 4aNETWORK\_accClassBts.0100]**  
05 Jun 2018 12:20:59,401 | WARN | TalendMP1555Prod | rg.apache.camel.util.CamelLogger 182 | 161 - org.apache.camel.camel-core - 2.15.4 | A20180605.1200+0100-1215+0100  
\_11666.xml.gz  
05 Jun 2018 12:20:59,432 | WARN | TalendMP1555Prod | rg.apache.camel.util.CamelLogger 182 | 161 - org.apache.camel.camel-core - 2.15.4 | A20180605.1200+0100-1215+0100  
\_22678.xml.gz  
05 Jun 2018 12:20:59,639 | WARN | TalendMP1555Prod | rg.apache.camel.util.CamelLogger 182 | 161 - org.apache.camel.camel-core - 2.15.4 | A20180605.1200+0100-1215+0100  
\_93575.xml.gz  
05 Jun 2018 12:20:59,652 | WARN | TalendMP1555Prod | rg.apache.camel.util.CamelLogger 182 | 161 - org.apache.camel.camel-core - 2.15.4 | A20180605.1200+0100-1215+0100  
\_22719.xml.gz  
05 Jun 2018 12:20:59,924 | WARN | TalendMP1555Prod | rg.apache.camel.util.CamelLogger 182 | 161 - org.apache.camel.camel-core - 2.15.4 | A20180605.1200+0100-1215+0100  
\_26336.xml.gz

The bold one in the log file is the multiline.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 5, 2018, 8:53pm UTC](https://discuss.elastic.co/t/logstash-log-file-creation/134602/2 "2018-06-05T20:53:08Z")

</div>

Has that actually been split into multiple lines? It looks like it just has been wrapped by whatever you've used to look at the log. See [https://www.elastic.co/guide/en/logstash/current/multiline.html](https://www.elastic.co/guide/en/logstash/current/multiline.html).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 3, 2018, 8:53pm UTC](https://discuss.elastic.co/t/logstash-log-file-creation/134602/3 "2018-07-03T20:53:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
