# Multiline Codec Error?

**URL:** <https://discuss.elastic.co/t/multiline-codec-error/86814>\
**Category:** Logstash\
**Created:** [May 23, 2017, 1:05pm UTC](https://discuss.elastic.co/t/multiline-codec-error/86814 "2017-05-23T13:05:31Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Yaswanth](https://avatars.discourse-cdn.com/v4/letter/y/94ad74/32.png) [@Yaswanth](https://discuss.elastic.co/u/Yaswanth)\
**Post date:** [May 23, 2017, 1:05pm UTC](https://discuss.elastic.co/t/multiline-codec-error/86814/1 "2017-05-23T13:05:31Z")

</div>

When i parsing the logs on TIMESTAMP field of multiline codec it is showing error output for the TIMESTAMP fields present in square brackets.

Config:

```
input {
  file {
    path => "D:\logstash\logstash-2.4.0\bin\slowlogs.txt"
    start_position => "beginning"
    codec => multiline {
        pattern => "^%{TIMESTAMP_ISO8601} "
        negate => true
        what => previous
    }
  }
}

output {
  stdout { codec => rubydebug }
}

```

Logs:

```
[2015-08-24 11:49:14,389] [INFO][env] [Letha] using [1] data paths, mounts [[/
(/dev/disk1)]], net usable_space [34.5gb], net total_space [118.9gb], types [hfs]
[2015-08-24 11:49:14,389] [INFO][env] [Letha] using [1] data paths, mounts [[/
(/dev/disk1)]], net usable_space [34.5gb], net total_space [118.9gb], types [hfs]
[2015-08-24 11:49:14,389] [INFO][env] [Letha] using [1] data paths, mounts [[/
(/dev/disk1)]], net usable_space [34.5gb], net total_space [118.9gb], types [hfs]

```

Output:

```
{
    "@timestamp" => "2017-05-23T11:19:10.635Z",
       "message" => "[2015-08-24 11:49:14,389] [INFO][env
] [Letha] using [1] data paths, mounts [[/\r\n(/dev/disk1)]], net usable_space [
34.5gb], net total_space [118.9gb], types [hfs]\r\n[2015-08-24 11:49:14,389] [IN
FO ][env] [Letha] using [1] data paths, mounts [[/\r\n(/de
v/disk1)]], net usable_space [34.5gb], net total_space [118.9gb], types [hfs]\r\
n[2015-08-24 11:49:14,389] [INFO][env] [Letha] using [1]
data paths, mounts [[/\r\n(/dev/disk1)]], net usable_space [34.5gb], net total_s
pace [118.9gb], types [hfs]\r\n\r\n\r",
      "@version" => "1",
          "tags" => [
        [0] "multiline"
    ],
          "path" => "D:\\logstash\\logstash-2.4.0\\bin\\slowlogs.txt",
          "host" => "PC326815"
}

```

The same logs removing it from []

```
2015-08-24 11:49:14,389 [INFO][env] [Letha] using [1] data paths, mounts [[/
(/dev/disk1)]], net usable_space [34.5gb], net total_space [118.9gb], types [hfs]
2015-08-24 11:49:14,389 [INFO][env] [Letha] using [1] data paths, mounts [[/
(/dev/disk1)]], net usable_space [34.5gb], net total_space [118.9gb], types [hfs]
2015-08-24 11:49:14,389 [INFO][env] [Letha] using [1] data paths, mounts [[/
(/dev/disk1)]], net usable_space [34.5gb], net total_space [118.9gb], types [hfs]

```

Executed the same config got output like this:

```
{
    "@timestamp" => "2017-05-23T11:25:48.075Z",
       "message" => "2015-08-24 11:49:14,389 [INFO][env]
[Letha] using [1] data paths, mounts [[/\r\n(/dev/disk1)]], net usable_space [3
.5gb], net total_space [118.9gb], types [hfs]\r",
      "@version" => "1",
          "tags" => [
        [0] "multiline"
    ],
          "path" => "D:\\logstash\\logstash-2.4.0\\bin\\slowlogs.txt",
          "host" => "PC326815"
}
{
    "@timestamp" => "2017-05-23T11:25:48.278Z",
       "message" => "2015-08-24 11:49:14,389 [INFO][env]
[Letha] using [1] data paths, mounts [[/\r\n(/dev/disk1)]], net usable_space [3
.5gb], net total_space [118.9gb], types [hfs]\r",
      "@version" => "1",
          "tags" => [
        [0] "multiline"
    ],
          "path" => "D:\\logstash\\logstash-2.4.0\\bin\\slowlogs.txt",
          "host" => "PC326815"
}
←[33mSIGINT received. Shutting down the agent. {:level=>:warn}←[0m
stopping pipeline {:id=>"main"}
{
    "@timestamp" => "2017-05-23T11:25:57.421Z",
       "message" => "2015-08-24 11:49:14,389 [INFO][env]
[Letha] using [1] data paths, mounts [[/\r\n(/dev/disk1)]], net usable_space [3
.5gb], net total_space [118.9gb], types [hfs]\r\n\r\n\r",
      "@version" => "1",
          "tags" => [
        [0] "multiline"
    ],
          "path" => "D:\\logstash\\logstash-2.4.0\\bin\\slowlogs.txt",
          "host" => "PC326815"
}

```

THIS is giving me proper output .How can i achieve the same for the TIMESTAMP field in [] brackets.

I also tried it by giving pattern =\> `"^\[%{TIMESTAMP_ISO8601}\] "`  
THANKS

---

<div class="post-metadata">

**Author:** ![Yaswanth](https://avatars.discourse-cdn.com/v4/letter/y/94ad74/32.png) [@Yaswanth](https://discuss.elastic.co/u/Yaswanth)\
**Post date:** [May 24, 2017, 3:27pm UTC](https://discuss.elastic.co/t/multiline-codec-error/86814/2 "2017-05-24T15:27:05Z")

</div>

The pattern is wrong in multiline codec . Worked fine when i used the below config:

```
input {
  file {
    path => "D:\logstash\logstash-2.4.0\bin\slowlogs.txt"
    start_position => "beginning"
    codec => multiline {
        pattern => "^\[%{TIMESTAMP_ISO8601:TIMESTAMP}\]"
        negate => true
        what => previous
    }
  }
}

output {
  stdout { codec => rubydebug }
}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 21, 2017, 3:27pm UTC](https://discuss.elastic.co/t/multiline-codec-error/86814/3 "2017-06-21T15:27:16Z")

</div>

Closed on June 21, 2017, 3:27pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.