# Logstash multiline pattern : continuous newline

**URL:** <https://discuss.elastic.co/t/logstash-multiline-pattern-continuous-newline/120993>\
**Category:** Logstash\
**Created:** [February 22, 2018, 6:55am UTC](https://discuss.elastic.co/t/logstash-multiline-pattern-continuous-newline/120993 "2018-02-22T06:55:03Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![byungik](https://avatars.discourse-cdn.com/v4/letter/b/3da27b/32.png) [@byungik](https://discuss.elastic.co/u/byungik)\
**Post date:** [February 22, 2018, 6:55am UTC](https://discuss.elastic.co/t/logstash-multiline-pattern-continuous-newline/120993/1 "2018-02-22T06:55:03Z")

</div>

This is my DB logs(CUBRID Slow query log).

'16-09-26 14:26:31.564 (35) execute\_all srv\_h\_id 14 DELETE FROM MSG\_RCV\_CC WHERE RCV\_ID = ?  
16-09-26 14:26:31.564 (35) bind 1 : VARCHAR (9)11282366  
16-09-26 14:26:33.987 (35) execute\_all 0 tuple 0 time 2.423'

16-09-26 15:47:19.344 (24) execute\_all srv\_h\_id 3 INSERT INTO MSG\_RCV\_TEMP\_QUEUE (RCV\_ID, SERVER\_SIGN,CREATE\_DATE) VALUES (?, ?, CURRENT\_TIMESTAMP)  
16-09-26 15:47:19.344 (24) bind 1 : BIGINT 11292925  
16-09-26 15:47:19.344 (24) bind 2 : VARCHAR (16)tcwhpsns-91a901  
16-09-26 15:47:19.346 (24) execute\_all error:-670 tuple 1 time 0.001, EID = 10

16-11-03 11:45:54.036 (24407) execute\_all srv\_h\_id 3 INSERT INTO MSG\_RCV\_TEMP\_QUEUE (RCV\_ID, SERVER\_SIGN,CREATE\_DATE) VALUES (?, ?, CURRENT\_TIMESTAMP)  
16-11-03 11:45:54.036 (24407) bind 1 : BIGINT 11304157  
16-11-03 11:45:54.036 (24407) bind 2 : VARCHAR (16)tcwhpsns-91a901  
16-11-03 11:45:54.037 (24407) execute\_all error:-670 tuple 1 time 0.001, EID = 214

I use multiline in my config file. I want to divide this log by empty line.  
But I couldn't split what I wanted. Because Each Line has similar patterns and I can't match empty line as regex.  
I need your help.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 22, 2018, 6:56am UTC](https://discuss.elastic.co/t/logstash-multiline-pattern-continuous-newline/120993/2 "2018-02-22T06:56:29Z")

</div>

> I can't match empty line as regex.

Why not?

```plaintext
multitline {
  pattern => "^$"
  what => "previous"
  negate => true
}

```

---

<div class="post-metadata">

**Author:** ![byungik](https://avatars.discourse-cdn.com/v4/letter/b/3da27b/32.png) [@byungik](https://discuss.elastic.co/u/byungik)\
**Post date:** [February 22, 2018, 7:00am UTC](https://discuss.elastic.co/t/logstash-multiline-pattern-continuous-newline/120993/3 "2018-02-22T07:00:46Z")

</div>

Thanks for reply .

It doesn't work properly. multline never end.  
I use mulitline like this. Is it any problem? I use logstash 6.1.1 version

input {  
stdin {  
codec =\> multiline {  
pattern =\> "^$"  
what =\> "previous"  
negate =\> true  
}  
}  
}  
filter {  
grok {  
match =\> { "message" =\> "%{DATE:date} %{TIME:time} %{DATA:id} %{GREEDYDATA:query}" }  
}  
if [query] =~ "error:" {  
dissect { mapping =\> { "query" =\> "execute\_all error:%{error} tuple %{tuple} time %{execute\_time}, EID = %{EID}" } }  
}  
else if [query] =~ "tuple" {  
dissect { mapping =\> { "query" =\> "execute\_all 0 tuple %{tuple} time %{execute\_time}" } }  
}  
else if [query] =~ "bind" {  
dissect { mapping =\> { "query" =\> "bind 1 : %{bind}" } }  
}  
if "\_grokparsefailure" in [tags] { drop{} }  
if ([execute\_time]) { mutate { convert =\> { "execute\_time" =\> "float" }}}  
}  
output {  
stdout { codec =\> "rubydebug" }  
}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 22, 2018, 7:08am UTC](https://discuss.elastic.co/t/logstash-multiline-pattern-continuous-newline/120993/4 "2018-02-22T07:08:39Z")

</div>

What does your test input look like? Have you looked into the codec's `auto_flush_interval` option?

---

<div class="post-metadata">

**Author:** ![byungik](https://avatars.discourse-cdn.com/v4/letter/b/3da27b/32.png) [@byungik](https://discuss.elastic.co/u/byungik)\
**Post date:** [February 22, 2018, 7:14am UTC](https://discuss.elastic.co/t/logstash-multiline-pattern-continuous-newline/120993/5 "2018-02-22T07:14:34Z")

</div>

my test input looks like this.

16-09-26 14:26:31.564 (35) execute\_all srv\_h\_id 14 DELETE FROM MSG\_RCV\_CC WHERE RCV\_ID = ?  
16-09-26 14:26:31.564 (35) bind 1 : VARCHAR (9)11282366  
16-09-26 14:26:33.987 (35) execute\_all 0 tuple 0 time 2.423

16-09-26 15:47:19.344 (24) execute\_all srv\_h\_id 3 INSERT INTO MSG\_RCV\_TEMP\_QUEUE (RCV\_ID, SERVER\_SIGN,CREATE\_DATE) VALUES (?, ?, CURRENT\_TIMESTAMP)  
16-09-26 15:47:19.344 (24) bind 1 : BIGINT 11292925  
16-09-26 15:47:19.344 (24) bind 2 : VARCHAR (16)tcwhpsns-91a901  
16-09-26 15:47:19.346 (24) execute\_all error:-670 tuple 1 time 0.001, EID = 10

16-11-03 11:45:54.036 (24407) execute\_all srv\_h\_id 3 INSERT INTO MSG\_RCV\_TEMP\_QUEUE (RCV\_ID, SERVER\_SIGN,CREATE\_DATE) VALUES (?, ?, CURRENT\_TIMESTAMP)  
16-11-03 11:45:54.036 (24407) bind 1 : BIGINT 11304157  
16-11-03 11:45:54.036 (24407) bind 2 : VARCHAR (16)tcwhpsns-91a901  
16-11-03 11:45:54.037 (24407) execute\_all error:-670 tuple 1 time 0.001, EID = 214

16-11-03 11:47:48.806 (24407) execute\_all srv\_h\_id 3 INSERT INTO MSG\_RCV\_TEMP\_QUEUE (RCV\_ID, SERVER\_SIGN,CREATE\_DATE) VALUES (?, ?, CURRENT\_TIMESTAMP)  
16-11-03 11:47:48.806 (24407) bind 1 : BIGINT 11304187  
16-11-03 11:47:48.806 (24407) bind 2 : VARCHAR (16)tcwhpsns-91a901  
16-11-03 11:47:48.808 (24407) execute\_all error:-670 tuple 1 time 0.001, EID = 215

16-11-03 11:51:34.351 (24407) execute\_all srv\_h\_id 3 INSERT INTO MSG\_RCV\_TEMP\_QUEUE (RCV\_ID, SERVER\_SIGN,CREATE\_DATE) VALUES (?, ?, CURRENT\_TIMESTAMP)  
16-11-03 11:51:34.351 (24407) bind 1 : BIGINT 11304189  
16-11-03 11:51:34.351 (24407) bind 2 : VARCHAR (16)tcwhpsns-91a901  
16-11-03 11:51:34.353 (24407) execute\_all error:-670 tuple 1 time 0.001, EID = 216

I've never looked into auto\_flush\_interval option....

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 22, 2018, 7:32am UTC](https://discuss.elastic.co/t/logstash-multiline-pattern-continuous-newline/120993/6 "2018-02-22T07:32:10Z")

</div>

How do you know your drop filter isn't dropping all events? If I delete all filters things work just fine.

---

<div class="post-metadata">

**Author:** ![byungik](https://avatars.discourse-cdn.com/v4/letter/b/3da27b/32.png) [@byungik](https://discuss.elastic.co/u/byungik)\
**Post date:** [February 22, 2018, 7:47am UTC](https://discuss.elastic.co/t/logstash-multiline-pattern-continuous-newline/120993/7 "2018-02-22T07:47:12Z")

</div>

I've just tried what you said.  
conf file that I've tried looks like this.

input {  
stdin {  
codec =\> multiline {  
pattern =\> "^$"  
what =\> "previous"  
negate =\> true  
}  
}  
}  
filter {  
}  
output {  
stdout { codec =\> "rubydebug" }  
}

And It doesn't work either.

I think multiline couldn't catch empty line with this pattern.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 22, 2018, 7:57am UTC](https://discuss.elastic.co/t/logstash-multiline-pattern-continuous-newline/120993/8 "2018-02-22T07:57:03Z")

</div>

Well, I copied and pasted your configuration (without the filters) and it worked with Logstash 2.4.0. If I can't reproduce the problem I can't help you.

---

<div class="post-metadata">

**Author:** ![byungik](https://avatars.discourse-cdn.com/v4/letter/b/3da27b/32.png) [@byungik](https://discuss.elastic.co/u/byungik)\
**Post date:** [February 22, 2018, 8:12am UTC](https://discuss.elastic.co/t/logstash-multiline-pattern-continuous-newline/120993/9 "2018-02-22T08:12:58Z")

</div>

Okay I understand. thanks for all your replies.  
It may be version problem or something.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 22, 2018, 8:13am UTC](https://discuss.elastic.co/t/logstash-multiline-pattern-continuous-newline/120993/10 "2018-03-22T08:13:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.