# Logstash multiline code pattern?

**URL:** https://discuss.elastic.co/t/logstash-multiline-code-pattern/71200
**Category:** Logstash
**Created:** [January 11, 2017, 9:58am UTC](https://discuss.elastic.co/t/logstash-multiline-code-pattern/71200 "2017-01-11T09:58:32Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![aviral\_srivastava](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aviral_srivastava/32/98018_2.png) [@aviral\_srivastava](https://discuss.elastic.co/u/aviral_srivastava)
#### Post date: [January 11, 2017, 9:58am UTC](https://discuss.elastic.co/t/logstash-multiline-code-pattern/71200/1 "2017-01-11T09:58:32Z")

</div>

Hi,

**OS: Windows7**  
**logstash2.1**  
**elasticsearch2.1.0**

I have following log file  
"01","12/1/2016 12:03:43 AM",""  
"02","STW4157","2016-12-01","00:03:43"  
"03","0","0","0","0","0","1","0"  
"04","AP 2.0 Mail Classify P03",""  
"05","2016-12-01","00:03:43","2016-12-01","00:03:44","Scan","64","STW4157","0","","0","0","0","0","0","0"  
"05","2016-12-01","00:03:49","2016-12-01","00:03:57","KTM Server","64","STW4155","0","","0","0","0","0","0","0"

"01","12/1/2016 12:03:45 AM",""  
"02","STW4157","2016-12-01","00:03:45"  
"03","0","0","0","0","0","1","0"  
"04","AP 2.0 Mail Classify P03",""  
"05","2016-12-01","00:03:45","2016-12-01","00:03:46","Scan","64","STW4157","0","","0","0","0","0","0","0"  
"05","2016-12-01","00:03:52","2016-12-01","00:03:59","KTM Server","64","STW4155","0","","0","0","0","0","0","0"

input{  
file{  
type =\> "logs"  
path =\> ["D:/chirag/Logfileanalysismonitoring/KOFAXlogs/KOFAXcapture\_1612\_2.log"]  
codec =\> multiline {  
negate =\> true  
pattern =\> "^\n"  
what =\> "previous"  
}  
}  
}

What pattern should I use inside multiline codec, The logs are separated by two newline as you can see. Can anybody help me please.

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [January 11, 2017, 10:00am UTC](https://discuss.elastic.co/t/logstash-multiline-code-pattern/71200/2 "2017-01-11T10:00:03Z")

</div>

Try `^$` as the pattern.

---

<div class="post-metadata">

### Author: ![aviral\_srivastava](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aviral_srivastava/32/98018_2.png) [@aviral\_srivastava](https://discuss.elastic.co/u/aviral_srivastava)
#### Post date: [January 11, 2017, 10:43am UTC](https://discuss.elastic.co/t/logstash-multiline-code-pattern/71200/3 "2017-01-11T10:43:55Z")

</div>

Hi,

@magnusbaeck  
I tried the pattern as you specified:-  
input{  
file{  
type =\> "logs"  
path =\> ["D:/chirag/Logfileanalysismonitoring/KOFAXlogs/KOFAXcapture\_1612\_2.log"]  
codec =\> multiline {  
negate =\> true  
pattern =\> "^$"  
what =\> "previous"  
}  
}  
}  
output{  
stdout { codec=\>rubydebug }  
}  
But logstash is not able to parse the file,  
 ![](https://us1.discourse-cdn.com/elastic/original/2X/7/7bd64809c74609eb2115a2b59bc10d267cb042c5.png)  
**It is stuck at logstash startup completed.**  
**What is this pattern matching ?**

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [January 11, 2017, 11:55am UTC](https://discuss.elastic.co/t/logstash-multiline-code-pattern/71200/4 "2017-01-11T11:55:26Z")

</div>

Have you cleared the sincedb file and set `start_position => beginning`?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 8, 2017, 11:56am UTC](https://discuss.elastic.co/t/logstash-multiline-code-pattern/71200/5 "2017-02-08T11:56:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.