# Mixed JSON input and Other Log files with Multiline codec

**URL:** https://discuss.elastic.co/t/mixed-json-input-and-other-log-files-with-multiline-codec/36696
**Category:** Logstash
**Created:** [December 9, 2015, 6:57am UTC](https://discuss.elastic.co/t/mixed-json-input-and-other-log-files-with-multiline-codec/36696 "2015-12-09T06:57:04Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Raggyman](https://avatars.discourse-cdn.com/v4/letter/r/d07c76/32.png) [@Raggyman](https://discuss.elastic.co/u/Raggyman)
#### Post date: [December 9, 2015, 6:57am UTC](https://discuss.elastic.co/t/mixed-json-input-and-other-log-files-with-multiline-codec/36696/1 "2015-12-09T06:57:04Z")

</div>

I have the following configured for input. My situation that I have a mix of different file formats that I need to process.

Some files are the generic type of file, that have the same start pattern for multiline, (a date) however I am running into the problem where I have some files that are just purely json format, and seem to be getting caught up in the multiline. Am just quickly wondering if here is a workaround, or the right way to do it. Don't really want to be running different ports if I can avoid it.

Thanks in advance.

```
input {

beats {
            port => 4445
            codec => multiline {
                 pattern => "^\d+"
                 negate => true
                what => "previous"
            }

    }

```

}

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [December 9, 2015, 7:32am UTC](https://discuss.elastic.co/t/mixed-json-input-and-other-log-files-with-multiline-codec/36696/2 "2015-12-09T07:32:58Z")

</div>

It's pretty clear that your current multiline pattern won't work for JSON lines that begin with a curly brace. Would changing the pattern to e.g. `^(\d+|\{")` help?

---

<div class="post-metadata">

### Author: ![Raggyman](https://avatars.discourse-cdn.com/v4/letter/r/d07c76/32.png) [@Raggyman](https://discuss.elastic.co/u/Raggyman)
#### Post date: [December 9, 2015, 10:48am UTC](https://discuss.elastic.co/t/mixed-json-input-and-other-log-files-with-multiline-codec/36696/3 "2015-12-09T10:48:31Z")

</div>

Ah yeah. Would have come to me eventually. Thanks heaps will give it a go in the morning.

Thanks again mate.

---

<div class="post-metadata">

### Author: ![Raggyman](https://avatars.discourse-cdn.com/v4/letter/r/d07c76/32.png) [@Raggyman](https://discuss.elastic.co/u/Raggyman)
#### Post date: [December 9, 2015, 10:50am UTC](https://discuss.elastic.co/t/mixed-json-input-and-other-log-files-with-multiline-codec/36696/4 "2015-12-09T10:50:52Z")

</div>

I was in the mode were at the input stage you would want to inspect the input type and then treat it in a particular way. I.e some logs you might want multi line and other log types you don't.

I spose you would just deal with those in the filter stage.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:19am UTC](https://discuss.elastic.co/t/mixed-json-input-and-other-log-files-with-multiline-codec/36696/5 "2017-07-06T05:19:24Z")

</div>


