# Logstash multiline issue - limit of size in single event
**URL:** https://discuss.elastic.co/t/logstash-multiline-issue-limit-of-size-in-single-event/283335
**Category:** Logstash
**Created:** [September 4, 2021, 7:48am UTC](https://discuss.elastic.co/t/logstash-multiline-issue-limit-of-size-in-single-event/283335 "2021-09-04T07:48:28Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@ErSumit](https://discuss.elastic.co/u/ErSumit)
#### Post date: [September 4, 2021, 7:48am UTC](https://discuss.elastic.co/t/logstash-multiline-issue-limit-of-size-in-single-event/283335/1 "2021-09-04T07:48:28Z")
Logstash file input configured with multiline pattern as
```auto
codec => multiline {
pattern => '^ {'
negate => true
what => previous
}
}
```
Input file consist of multiple json objects. This multiline pattern w=works as expected for most of events, but strange it has created two event/message for single json object. Where logstash created first message starting with expected pattern of two white spaces and '{' but the second line is created at point where there are **four spaces at start of line** like ` ^ {`, which is not matching logstash pattern `^ {` **having two spaces at start of line.**
Ideally the second line created by logstash should have been appended to first line to form complete json object
---
### Author:  [@ErSumit](https://discuss.elastic.co/u/ErSumit)
#### Post date: [September 4, 2021, 7:52am UTC](https://discuss.elastic.co/t/logstash-multiline-issue-limit-of-size-in-single-event/283335/2 "2021-09-04T07:52:09Z")
I suspect if there is limit of lines or characters for multiline filter or logstash input filter, but I don't find any warning in log messages.
**The size of JSON object which was divided into two lines instead of one is 4.6K & 94 lines**
& the event/message created by logstash is merged with next JSON object creating message on elasticsearch of **500 lines and 21K size**
I guess this gives hint to the size limit?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [September 4, 2021, 5:15pm UTC](https://discuss.elastic.co/t/logstash-multiline-issue-limit-of-size-in-single-event/283335/3 "2021-09-04T17:15:40Z")
The max\_lines and max\_bytes options for the multiline codec are [documented](https://www.elastic.co/guide/en/logstash/current/plugins-codecs-multiline.html#plugins-codecs-multiline-max_lines).
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 2, 2021, 5:16pm UTC](https://discuss.elastic.co/t/logstash-multiline-issue-limit-of-size-in-single-event/283335/4 "2021-10-02T17:16:27Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.