# Multiline codec and csv filter

**URL:** https://discuss.elastic.co/t/multiline-codec-and-csv-filter/92016
**Category:** Logstash
**Created:** [July 6, 2017, 5:10am UTC](https://discuss.elastic.co/t/multiline-codec-and-csv-filter/92016 "2017-07-06T05:10:58Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![Yimjunhyeok](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yimjunhyeok/32/19052_2.png) [@Yimjunhyeok](https://discuss.elastic.co/u/Yimjunhyeok)
#### Post date: [July 6, 2017, 5:10am UTC](https://discuss.elastic.co/t/multiline-codec-and-csv-filter/92016/1 "2017-07-06T05:10:58Z")

</div>

This is source (2 logs)

172.16.110.11|ABC|!|@|#|abcd  
abcdkasjdlaskd  
asdsadlksadklsdakl |!|@|#|  
123.123.11.1|ddaskd|!|@|#|skdlsadsakdljadd,vcmacl

askdlsad ask dkas dska d |!|@|#|

Seperator ==\> | , |!|@|#|  
Column ==\> SrcIP, GroupID, Cookie

input {  
file {  
path =\> "/root/elastic/newline.txt"  
start\_position =\> "beginning"  
stdin {  
codec =\> multiline {  
pattern =\> "\n"  
negate =\> true  
what =\> previous  
}  
}  
sincedb\_path =\> "/dev/null"  
}  
}

filter {  
csv {  
separator =\> "|\*|!|#||"  
columns =\> ["GroupID", "Cookie"]  
quote\_char =\> "Æ"  
}  
if [GroupID] {  
csv {  
separator =\> "|"  
autogenerate\_column\_names =\> false  
quote\_char =\> "Æ"  
}  
}  
}

But now work. Last field including many new lines. So how to solve this problem with multiline codec and csv filter ?

i think,

Firstly using codec "multiline" ==\> Make an log with 1 line via multiline codec ==\> Parsing with csv filter.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 3, 2017, 5:10am UTC](https://discuss.elastic.co/t/multiline-codec-and-csv-filter/92016/2 "2017-08-03T05:10:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
