# Lumberjack input + grok and multiline

**URL:** <https://discuss.elastic.co/t/lumberjack-input-grok-and-multiline/37739>\
**Category:** Logstash\
**Created:** [December 22, 2015, 9:09am UTC](https://discuss.elastic.co/t/lumberjack-input-grok-and-multiline/37739 "2015-12-22T09:09:29Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![nkoleff](https://avatars.discourse-cdn.com/v4/letter/n/d9b06d/32.png) [@nkoleff](https://discuss.elastic.co/u/nkoleff)\
**Post date:** [December 22, 2015, 9:09am UTC](https://discuss.elastic.co/t/lumberjack-input-grok-and-multiline/37739/1 "2015-12-22T09:09:29Z")

</div>

Hello,

I have to combine logstash's lumberjack input, which in my case is the main shipper for all types of logs from centralized location to logstash and then I need to filter it with grok. So far so good - but the issue is that my logs are multiline.

I'm using the logstash filter Multiline and not the codec multiline as I have a single input of logs, and not all of my logs are multiline.

So my questions are:

1. Can I have multime lumberjack inputs on the same port, with just separating by log type. At the moment my lumberjack input looks like this:

input {  
lumberjack {  
port =\> 5000  
type =\> "logs"  
ssl\_certificate =\> "/etc/pki/tls/secure.crt"  
ssl\_key =\> "/etc/pki/tls/secure.key"  
}  
2. How to combine the grok and the multiline filter? So far I managed to get the multilines but I can not parse the message properly (by fields) - to every message I get \_grokparsefailure.

My filter looks like this:  
filter  
{  
if [type] == "applog" {  
multiline {  
pattern =\> "^%{TIMESTAMP\_ISO8601} "  
negate =\> "true"  
what =\> "previous"  
}

```
grok {
	match => {
	"message" => ["%{APPLOG}"] # this is my custom log pattern which you can find below
         }
    }
date {
	match => ["apptimestamp","YYYY-MM-dd HH:mm:ss,SSS","ISO8601"]
	target => "@timestamp"
	locale => "en"
            }
    }

```

}

And %{APPLOG} equals to

%{TIMESTAMP\_ISO8601:syslogtimestamp}%{SPACE}%{IPORHOST:servername}%{SPACE}%{GREEDYDATA:appender}:%{SPACE}%{TIMESTAMP\_ISO8601:apptimestamp}%{SPACE}[%{NUMBER:thread}]%{SPACE}%{GREEDYDATA:appcomponent}\t%{GREEDYDATA:merchant}\t%{LOGLEVEL:loglevel}%{SPACE}%{NUMBER:appmaintrxid}%{SPACE}%{IPORHOST:servername}\t%{GREEDYDATA:appmessage}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:17am UTC](https://discuss.elastic.co/t/lumberjack-input-grok-and-multiline/37739/2 "2017-07-06T05:17:35Z")

</div>

Closed on July 6, 2017, 5:17am UTC