# Logstash Tomcat multiline
**URL:** https://discuss.elastic.co/t/logstash-tomcat-multiline/41861
**Category:** Logstash
**Created:** [February 16, 2016, 9:17am UTC](https://discuss.elastic.co/t/logstash-tomcat-multiline/41861 "2016-02-16T09:17:35Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@Marcello\_A](https://discuss.elastic.co/u/Marcello_A)
#### Post date: [February 16, 2016, 9:17am UTC](https://discuss.elastic.co/t/logstash-tomcat-multiline/41861/1 "2016-02-16T09:17:35Z")
Hi All,
we moved our testing environment from Logstash 1.x to the latest version 2.2.x and we have to import some multiline events from an Openfire instance. The log entries are single lines and in some case an exception like this.
`indent preformatted text by 4 spaces`
2016.02.15 22:41:31 org.jivesoftware.openfire.handler.PresenceUpdateHandler - Internal server error. Triggered by packet: .....
`indent preformatted text by 4 spaces`
We tried to create this rule with the multiline codec but it doesn't work correctly (the lines are skipped).
`indent preformatted text by 4 spaces`
file {
path =\> "/mnt/openfire/logs/info.log\*"
exclude =\> "\*.gz"
type =\> "openfire"
start\_position =\> "end"
sincedb\_path =\> "/opt/logstash/tmp/openfire-info.db"
sincedb\_write\_interval =\> 30
add\_field =\> { "verbosity" =\> "INFO" }
codec =\> multiline {
pattern =\> "^%{YEAR}.%{MONTHNUM}.%{MONTHDAY}"
negate =\> true
what =\> previous
}
}
`indent preformatted text by 4 spaces`
Could someone help us to debug this behavior?
Thanks,
Marcello
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:11am UTC](https://discuss.elastic.co/t/logstash-tomcat-multiline/41861/2 "2017-07-06T05:11:16Z")