# Logstash multiline filter pattern match -- needing help please \*\*Solved \*\*

**URL:** https://discuss.elastic.co/t/logstash-multiline-filter-pattern-match-needing-help-please-solved/54440
**Category:** Logstash
**Created:** [June 30, 2016, 4:01pm UTC](https://discuss.elastic.co/t/logstash-multiline-filter-pattern-match-needing-help-please-solved/54440 "2016-06-30T16:01:35Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![davehatma](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davehatma/32/29322_2.png) [@davehatma](https://discuss.elastic.co/u/davehatma)
#### Post date: [June 30, 2016, 4:01pm UTC](https://discuss.elastic.co/t/logstash-multiline-filter-pattern-match-needing-help-please-solved/54440/1 "2016-06-30T16:01:35Z")

</div>

I was testing multiline in file section but DID NOT have a filter section. I included an empty filter section and its working.

I am trying to get LogStash to combine a log file with multilines defining an event. The "trigger" for a new event has the term "ICSubCall" embedded as a word in the log line.

## Here is my config input segment:

## input { file { codec =\> plain { charset =\> "CP1252" } path =\> "/mnt/hgfs/VMShared/logs/uvcs/uvcs\*" ignore\_older =\> 5184000 close\_older =\> 15 type =\> "uvcs" start\_position =\> "beginning" codec =\> multiline { pattern =\> "/\bICSubCall\b/" negate =\> true what =\> previous } sincedb\_path =\> "/root/since\_db\_files/sincedb\_uvcs" } }

## And here is a segment of the logs:

## Wed Jun 29 01:32:59; errno=0: ICSubCall args=7,name=UO.SPIDER, Wed Jun 29 01:32:59; errno=0: arg[0]=HTTP\_USER\_AGENTþJNI\_QUERYþSPIDER\_VERSIONþRGWHOSTþRGWADDRþPATH\_INFO, Wed Jun 29 01:32:59; errno=0: arg[1]=redbeans=1þ1þ101þdsb-p07.maeagle.corpþ192.168.18.11þ/dmc/PRODUCTS:ProductDetail,this.getCalcProdInfo, Wed Jun 29 01:32:59; errno=0: arg[2]=, Wed Jun 29 01:32:59; errno=0: arg[3]=, Wed Jun 29 01:32:59; errno=0: arg[4]=, Wed Jun 29 01:32:59; errno=0: arg[5]=reqParentIDþorigProdIdsþprodSiteTypeþprocessNameþisMAProdþseqIDþprodLineTypeþprodOverridesþlangCodeþprodIdsþprodTaxPctþspecProcFormulaIDþprodRetailsþchargeNoCostFlagþpayingIDþmarkUpPctþpromoCodeþenableFreeShippingþlastTimeUpdatedþdistIDþmpaIDþsiteTypeþorderSourceþstdCashBackAmtþdiscPctþprodQtysþprodCostsþempIDþshipStateþshipCountryþprodTaxCostþorigQtysþtlsFitFlagþprodBvsþcampaignRestrictþpersonalConsþpcIdþsiteCntryþprodTaxAmtþmerchCountryþlastDateUpdatedþprodIbvsþmaImageURLþisCampaignþHID\_FORM\_INSTþredbeansþcomo, Wed Jun 29 01:32:59; errno=0: arg[6]=dd0ac865-4760-4d4f-8f3c-3f010859241bþC13029ýC6217þUýUþþ1ý1þþþ0ý0þENGþC13029ýC6217þþ0ý0þþ0þ648034486þþþ0þ01:29amý01:28amþ648034486þþUþþ0ý0þþ7ý2þþþBCþCANþþ7ý2þþþ0ý0þ0þþUSAþþCANþ06/29/2016ý06/29/2016þþ//images.marketamerica.com/images/USA/shopping/products/þ0ý0þþ1þ1, Wed Jun 29 01:32:59; errno=0: uvapi\_server non execute command. Wed Jun 29 01:32:59; errno=0: api\_slave: function code=52. Wed Jun 29 01:32:59; errno=0: ICSubCall args=7,name=UO.SPIDER, Wed Jun 29 01:32:59; errno=0: arg[0]=HTTP\_USER\_AGENTþJNI\_QUERYþSPIDER\_VERSIONþRGWHOSTþRGWADDRþPATH\_INFO, Wed Jun 29 01:32:59; errno=0: arg[1]=redbeans=1þ1þ101þdsb-p09.maeagle.corpþ192.168.18.13þ/dmc/SERVICES:WebServices,this.getCreditUser, Wed Jun 29 01:32:59; errno=0: arg[2]=, Wed Jun 29 01:32:59; errno=0: arg[3]=, Wed Jun 29 01:32:59; errno=0: arg[4]=, Wed Jun 29 01:32:59; errno=0: arg[5]=langCodeþpcIDþisSiteBrandedþsiteTypeþreqParentIDþsiteCountryþcreditUserþrepIDþHID\_FORM\_INSTþredbeansþcomo, Wed Jun 29 01:32:59; errno=0: arg[6]=CHIþ1897767þþUþ0dd585ab-a999-4575-91a8-4a60bf14b085þTWNþþ3431475þþ1þ1, Wed Jun 29 01:32:59; errno=0: uvapi\_server non execute command. Wed Jun 29 01:32:59; errno=0: api\_slave: function code=52.

As you can see, I'm trying to use the regex word boundary pattern as the "new" event trigger. I have tried changing negate to true/false and what to next/previous; but LogStash will not combine the lines into a single message.

I have checked the regex against the on-line test utility ( [https://regex101.com/](https://regex101.com/) ) and it works as a match there.

It seems fairly straight forward, but I just can't seem to get it to work. Any help would be most appreciated.

Thanks,

Dave

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:49am UTC](https://discuss.elastic.co/t/logstash-multiline-filter-pattern-match-needing-help-please-solved/54440/2 "2017-07-06T04:49:53Z")

</div>