# Logstash Multiline Codec skipping first messages

**URL:** <https://discuss.elastic.co/t/logstash-multiline-codec-skipping-first-messages/44339>\
**Category:** Logstash\
**Created:** [March 14, 2016, 4:08pm UTC](https://discuss.elastic.co/t/logstash-multiline-codec-skipping-first-messages/44339 "2016-03-14T16:08:25Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![rakesh76](https://avatars.discourse-cdn.com/v4/letter/r/839c29/32.png) [@rakesh76](https://discuss.elastic.co/u/rakesh76)\
**Post date:** [March 14, 2016, 4:08pm UTC](https://discuss.elastic.co/t/logstash-multiline-codec-skipping-first-messages/44339/1 "2016-03-14T16:08:25Z")

</div>

Hi

I am using following configuration file to process multi-line logs. It seems logstash is always skipping first message from log file and not saving in elasticsearch

```
input {
file {
    type => "logs"
	#path => ["C:/Users/x7358/Documents/logs/Test4/**/*performance*soap*"]
	path => ["C:/Users/Perf/*performance*soap*"]
	start_position => "beginning"
	ignore_older => 0
    codec => multiline {
     pattern => "^%{TIMESTAMP_ISO8601}"
	 negate => true
     what => "previous"
    }
}
}

filter {
   grok {
  match => { "message" => "%{TIMESTAMP_ISO8601:timestamp}%{SPACE}\{(?<thread>[^)]+)\}%{SPACE}%{WORD:payload}:\s%{GREEDYDATA:msg}" }
}
    date {
        match => ["timestamp", "yyyy-MM-dd HH:mm:ss,SSS"]
}

  mutate {
gsub => [
  "msg", "&lt;", "<",
  "msg", "&gt;", ">"
]
  }

  xml {
source => "msg"
target => "message_parsed"
remove_namespaces => true
store_xml => false
xpath => [
	"/Envelope/Body/Execute_SHResponse/Execute_SHResult/*/@RequestID", "RequestID",
	"/Envelope/Body/Execute_SHResponse/Execute_SHResult/CalcOut/*/@ReturnCode", "ReturnCode",
	"local-name(/Envelope/Body/Execute_SHResponse/Execute_SHResult/*)", "RequestType",
	"local-name(/Envelope/Body/Execute_SH/Request/*)", "RequestType"
  ]
  remove_field => ["xml","@timestamp","thread","payload","message","tags"]
   }
  }

output {

stdout {
    codec => rubydebug
} 

elasticsearch {
hosts => ["127.0.0.1:9200"]
action => "create"
index => "test"
  }
}

```

1. can you guide me what could be the wrong in my config file which skipping 1sets of message.

2. Also what could be the write configuration for Elasticsearch as it's not creating index automatically when I start processing my file

Thanks

---

<div class="post-metadata">

**Author:** ![rakesh76](https://avatars.discourse-cdn.com/v4/letter/r/839c29/32.png) [@rakesh76](https://discuss.elastic.co/u/rakesh76)\
**Post date:** [March 15, 2016, 12:10pm UTC](https://discuss.elastic.co/t/logstash-multiline-codec-skipping-first-messages/44339/2 "2016-03-15T12:10:50Z")

</div>

can anyone help me on this ?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:06am UTC](https://discuss.elastic.co/t/logstash-multiline-codec-skipping-first-messages/44339/3 "2017-07-06T05:06:55Z")

</div>