# Logstash spilt filter set defaut conf error

**URL:** <https://discuss.elastic.co/t/logstash-spilt-filter-set-defaut-conf-error/86349>\
**Category:** Logstash\
**Created:** [May 19, 2017, 3:05am UTC](https://discuss.elastic.co/t/logstash-spilt-filter-set-defaut-conf-error/86349 "2017-05-19T03:05:28Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![dean-river](https://avatars.discourse-cdn.com/v4/letter/d/4bbf92/32.png) [@dean-river](https://discuss.elastic.co/u/dean-river)\
**Post date:** [May 19, 2017, 3:05am UTC](https://discuss.elastic.co/t/logstash-spilt-filter-set-defaut-conf-error/86349/1 "2017-05-19T03:05:28Z")

</div>

I use one logstash multiline codec to merge multiline to one event ,and use spilt to spilt the multiline. the multiine logstash conf it like this:  
input{  
file{  
path =\> "/home/web\_server/report.log"  
sincedb\_path =\> "/home/web\_server/.sincedb"  
start\_position =\>end  
codec =\> multiline{  
pattern =\> "^"  
negate =\> false  
what =\> "previous"  
auto\_flush\_interval =\> 0.5  
max\_lines =\> 100  
}  
}  
}

output{  
http{  
url =\> "[http://127.0.0.1:8282/](http://127.0.0.1:8282/)"  
http\_method =\> get  
}  
}

and spilt com is like this:  
input{  
http{  
port =\> 8282  
response\_headers =\> {"Content-Type"=\>"text/json"}  
threads =\> 8  
}  
}

filter {  
split {  
field =\> "message"  
terminator =\> "\n"  
}

```
json {
	source => "message"
	remove_field => ["message", "path", "@version", "headers", "tags"]
}

```

}

output{  
file {  
path =\> "/home/web\_server/result.log"  
}  
}

when i run to logstash use the up two conf, the result.log is much less than report.log. it seems the spilt filter only got one line form a batch event with multiline.

but when is remove the conf in spilt{} just us spilt like bellow  
spilt {  
}  
the result is same as report .log.

spilt.filed default conf is "message" and terminator default conf is "\n". is there any different bettwen write defult conf or not write

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 16, 2017, 3:05am UTC](https://discuss.elastic.co/t/logstash-spilt-filter-set-defaut-conf-error/86349/2 "2017-06-16T03:05:43Z")

</div>

Closed on June 16, 2017, 3:05am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.