# Multiline codec applied (without multiline in logs) **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [March 24, 2017, 9:35am UTC](https://discuss.elastic.co/t/multiline-codec-applied-without-multiline-in-logs/79868 "2017-03-24T09:35:34Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![rosselg](https://avatars.discourse-cdn.com/v4/letter/r/f14d63/32.png) [@rosselg](https://discuss.elastic.co/u/rosselg)\ **Post date:** [March 24, 2017, 9:35am UTC](https://discuss.elastic.co/t/multiline-codec-applied-without-multiline-in-logs/79868/1 "2017-03-24T09:35:34Z")
Hi folks, Filebeat applies the "multiline coded", even if the log file doesn't contains any multiline logs. I guess this is related to Drupal log mechanism, as the log file is written every 10sec. with all the logs that occurred during the last 10sec (I assume for less Disk's I/O). ## My filebeat is configured as follow: filebeat: prospectors: - input\_type: log paths: - /home//tomcat/logs/access\_2017-03-24.log fields: app\_type: \ app\_name: \ ## output: logstash: enabled: true hosts: ["ELK:5045"] Logstash is configured with the following pattern: ``` match => { 'message' => '%{IPORHOST:clientip} %{USER:ident} %{USER:auth} \[%{HTTPDATE:logdate}\] "(?:%{WORD:method} %{URIPATH:URLpath}(?:%{URIPARAM:URLquery})?(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})" %{NUMBER:responseCode} (?:%{NUMBER:bytes}|-) %{QS:referrer} %{QS:agent} %{NUMBER:responseTime} \[id\: %{WORD:XSolidRequestID}\]'} ``` And the context.xml is the following: pattern="%{X-Forwarded-For}i %l %u %t "%r" %s %b "%{Referer}i" "%{User-Agent}i" %D [id: %{X-Request-ID}r]" Many thanks in advance! Greg ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [March 27, 2017, 8:13am UTC](https://discuss.elastic.co/t/multiline-codec-applied-without-multiline-in-logs/79868/2 "2017-03-27T08:13:46Z")
- Could you share some example log output from the drupal? - Do you have single and multiline mixed in one log file? - Could you share your full logstash config? Use 3 ` (ticks) around the code to preserve indentation ---
**Author:** ![rosselg](https://avatars.discourse-cdn.com/v4/letter/r/f14d63/32.png) [@rosselg](https://discuss.elastic.co/u/rosselg)\ **Post date:** [March 27, 2017, 9:54am UTC](https://discuss.elastic.co/t/multiline-codec-applied-without-multiline-in-logs/79868/3 "2017-03-27T09:54:35Z")
Hi @ruflin, Thanks for your response. **Here some logs output:** > 10.10.10.50 - - [24/Mar/2017:23:59:56 +0100] "GET /myAPP/myAPPapi/quotes/1102994-SWX-CHF?fields=CASH\_LINK,M\_NAME,M\_TREND,M\_CUR:value:id,SC\_GROUPED,M\_VALOR,M\_SYMB,M\_MARKET:value:id,M\_ISIN,COMPFULLNAME,LVAL,I\_NET\_VPERPR\_V,I\_NET\_VPERPR\_V\_PR,EUSIPA:id&autologin=myAPP\_0 HTTP/1.0" 200 783 "-" "Drupal (+http://drupal.org/)" 38 [id: 1a5c557a6790c80eaf40dcec8b58e170] > 10.10.10.50 - - [24/Mar/2017:23:59:58 +0100] "GET /myAPP/myAPPapi/quotes/833034-MUC-EUR?fields=CASH\_LINK,M\_NAME,M\_TREND,M\_CUR:value:id,SC\_GROUPED,M\_VALOR,M\_SYMB,M\_MARKET:value:id,M\_ISIN,COMPFULLNAME,LVAL,I\_NET\_VPERPR\_V,I\_NET\_VPERPR\_V\_PR,EUSIPA:id&autologin=myAPP\_0 HTTP/1.0" 200 628 "-" "Drupal (+http://drupal.org/)" 39 [id: b3cb93b8da5136c37a4341303437247a] > 10.10.10.50 - - [24/Mar/2017:23:59:58 +0100] "GET /myAPP/ext/fragments/details/fields/833034%2CMUC%2CEUR?style=fragment.detail.equ.aktuelledaten.1&tableId=aktuelledaten-1&decorator=markupOnly HTTP/1.0" 200 1970 "-" "Drupal (+http://drupal.org/)" 18 [id: 97b013d3163575f3f8287a54fd63b611] > 10.10.10.50 - - [24/Mar/2017:23:59:58 +0100] "GET /myAPP/ext/fragments/details/fields/833034%2CMUC%2CEUR?style=fragment.detail.equ.aktuelledaten.2&tableId=aktuelledaten-2&decorator=markupOnly HTTP/1.0" 200 2433 "-" "Drupal (+http://drupal.org/)" 12 [id: ebef4d653a12fd3879fdfa62120a2df4] > 10.10.10.50 - - [24/Mar/2017:23:59:58 +0100] "GET /myAPP/myAPPapi/quotes/833034-muc-eur?fields=M\_MARKET:id&autologin=myAPP\_0 HTTP/1.0" 200 332 "-" "Drupal (+http://drupal.org/)" 34 [id: 91f0fe9a72b610344f702c4f82fef8c7] No, it should only be single line inside Regarding the **logstash config** : 01-input: > beats { > port =\> 5045 > ssl =\> true > ssl\_certificate =\> "logstash-forwarder.crt" > ssl\_key =\> "logstash-forwarder.key" > } 10- filter: > if [fields][app\_type] == "myAPP" { > grok { > match =\> { 'message' =\> '%{IPORHOST:clientip} %{USER:ident} %{USER:auth} [%{HTTPDATE:logdate}] "(?:%{WORD:method} %{URIPATH:URLpath}(?:%{URIPARAM:URLquery})?(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})" %{NUMBER:responseCode} (?:%{NUMBER:bytes}|-) %{QS:referrer} %{QS:agent} %{NUMBER:responseTime} [id: %{WORD:XRequestID}]'} > } > mutate { > convert =\> { "responseTime" =\> "integer" } > } > date { > match =\> ["logdate", "dd/MMM/YYYY:HH:mm:ss Z"] > target =\> "logdate" > } 20-Output > } else if [fields][app\_name] == "myAPP" { > elasticsearch { > hosts =\> ["127.0.0.1:9200"] > index =\> "log-myAPP-%{+YYYY.MM.dd}" > user =\> > password =\> > } ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [March 28, 2017, 8:14am UTC](https://discuss.elastic.co/t/multiline-codec-applied-without-multiline-in-logs/79868/4 "2017-03-28T08:14:40Z")
having no multiline configured in filebeat, filebeat will not execute any multiline logic at all. Filebeat splits the log file on `\r\`, `\n` or `\r\n` symbol. Have you checked you log-file in an hex-editor containing newline symbols (0x0A, 0x0D) ? ---
**Author:** ![rosselg](https://avatars.discourse-cdn.com/v4/letter/r/f14d63/32.png) [@rosselg](https://discuss.elastic.co/u/rosselg)\ **Post date:** [March 28, 2017, 10:34am UTC](https://discuss.elastic.co/t/multiline-codec-applied-without-multiline-in-logs/79868/5 "2017-03-28T10:34:17Z")
Hi guys, It was my mistake... I had the wrong port configured on a host. Thus, it was trying to apply the multiline pattern. Thanks for the your help ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 25, 2017, 10:34am UTC](https://discuss.elastic.co/t/multiline-codec-applied-without-multiline-in-logs/79868/6 "2017-04-25T10:34:25Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.