# Logstash multuline not working

**URL:** <https://discuss.elastic.co/t/logstash-multuline-not-working/144701>\
**Category:** Logstash\
**Created:** [August 16, 2018, 11:05am UTC](https://discuss.elastic.co/t/logstash-multuline-not-working/144701 "2018-08-16T11:05:05Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![shani\_angarkadu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shani_angarkadu/32/50638_2.png) [@shani\_angarkadu](https://discuss.elastic.co/u/shani_angarkadu)\
**Post date:** [August 16, 2018, 11:05am UTC](https://discuss.elastic.co/t/logstash-multuline-not-working/144701/1 "2018-08-16T11:05:05Z")

</div>

Logstash multiline not working.

```auto
2018-08-09 04:15:13,307 Closed connection at 8/9/2018 4:15:13 AM -04:00 <<INFO .Data.AppDbContext [t23]>>
2018-08-09 04:15:13,307 Unexpected error in time zone update <<ERROR UpdateTimeZones [t23]>>
Oracle.ManagedDataAccess.Client.OracleException (0x80004005): ORA-00001: unique constraint (LINK_OD_IREPORT_2.TIME_ZONES_PK) violated
ORA-06512: at "LINK_OD_IREPORT_2.SET_MEETING_TIMEZONE", line 23
ORA-06512: at line 1
   at OracleInternal.ServiceObjects.OracleConnectionImpl.VerifyExecution(Int32& cursorId, Boolean bThrowArrayBindRelatedErrors, SqlStatementType sqlStatementType, Int32 arrayBindCount, OracleException& exceptionForArrayBindDML, Boolean& hasMoreRowsInDB, Boolean bFirstIterationDone)

2018-08-09 04:15:13,307 Closed connection at 8/9/2018 4:15:13 AM -04:00 <<INFO .Data.AppDbContext [t23]>>

```

tried all the combinations of logstash.

```auto
input { 

  file {
    path => "C:/Users/ss/Downloads/test6/*"
    start_position => "beginning"
    codec => multiline {
                   pattern => "^%{TIMESTAMP_ISO8601} "
                    negate => true
                    what => "previous"
                }
      }   
} 
output {
    stdout { codec => rubydebug }
}

with regex

codec => multiline {
                   pattern => '^[0-9]{4}-[0-9]{2}-[0-9]{2}'
                    negate => true
                    what => "previous"
                }
      }

```

output:

```auto
{
       "message" => "2018-08-09 04:15:13,307 Closed connection at 8/9/2018 4:15:13 AM -04:00 <<INFO Data.AppDbContext [t23]>>\r",
          "path" => "C:/Users/ss/Downloads/test8/test1.LOG",
      "@version" => "1",
    "@timestamp" => 2018-08-15T22:59:06.089Z
}

```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 16, 2018, 11:08am UTC](https://discuss.elastic.co/t/logstash-multuline-not-working/144701/2 "2018-08-16T11:08:11Z")

</div>

Do you **only** get that single event when Logstash processes the example file with three events? Or what's the problem?

---

<div class="post-metadata">

**Author:** ![shani\_angarkadu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shani_angarkadu/32/50638_2.png) [@shani\_angarkadu](https://discuss.elastic.co/u/shani_angarkadu)\
**Post date:** [August 16, 2018, 11:22am UTC](https://discuss.elastic.co/t/logstash-multuline-not-working/144701/3 "2018-08-16T11:22:05Z")

</div>

Yes sir I got only one single event.

---

<div class="post-metadata">

**Author:** ![shani\_angarkadu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shani_angarkadu/32/50638_2.png) [@shani\_angarkadu](https://discuss.elastic.co/u/shani_angarkadu)\
**Post date:** [August 16, 2018, 2:13pm UTC](https://discuss.elastic.co/t/logstash-multuline-not-working/144701/4 "2018-08-16T14:13:21Z")

</div>

Any help?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 16, 2018, 6:16pm UTC](https://discuss.elastic.co/t/logstash-multuline-not-working/144701/5 "2018-08-16T18:16:08Z")

</div>

I don't think the problem is related to your multiline configuration. Have you tried clearing your sincedb file or setting `sincedb_path => "nul"` in your file input in order to force the file to be (re)read from the top?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 16, 2018, 6:21pm UTC](https://discuss.elastic.co/t/logstash-multuline-not-working/144701/6 "2018-08-16T18:21:54Z")

</div>

Try adding an auto\_flush\_interval to your multiline codec.

```
auto_flush_interval => 5
```

---

<div class="post-metadata">

**Author:** ![shani\_angarkadu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shani_angarkadu/32/50638_2.png) [@shani\_angarkadu](https://discuss.elastic.co/u/shani_angarkadu)\
**Post date:** [August 16, 2018, 9:52pm UTC](https://discuss.elastic.co/t/logstash-multuline-not-working/144701/7 "2018-08-16T21:52:12Z")

</div>

both worked. thanks a lot!!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 13, 2018, 9:52pm UTC](https://discuss.elastic.co/t/logstash-multuline-not-working/144701/8 "2018-09-13T21:52:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.