# Multiline codec/filter not working **URL:** \ **Category:** Logstash\ **Created:** [March 22, 2016, 1:39pm UTC](https://discuss.elastic.co/t/multiline-codec-filter-not-working/45110 "2016-03-22T13:39:07Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![sunilmchaudhari](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sunilmchaudhari/32/9475_2.png) [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\ **Post date:** [March 22, 2016, 1:39pm UTC](https://discuss.elastic.co/t/multiline-codec-filter-not-working/45110/1 "2016-03-22T13:39:08Z")
Hi, We have logs form one system as below ``` Mar 22 13:08:14 hostname40 SYSLOG 7194 - - INFO;2016-03-22T15:08:14.604+0200;VM;-;There is no blacklist entry for '12345.9998.67890';-;-;-;-;blacklistRest.js;-;- Mar 22 13:08:17 hostname38 SYSLOG_ALARM 7883 - - INFO;2016-03-22T15:08:17.130+0200;VM;-;;ALARM - VM;-;M6 - Transaction 'TSS_AS2-3641-SPP_appName_9005_6666_1-RSS_PROD.1458652097.76-RECEIVED-0' received for card '12345.9998.67890' with unknown applicationIssuer/applicationOwner couple ([12345]/[9998]) Mar 22 13:08:17 hostname38 SYSLOG_ALARM 7883 - - INFO;2016-03-22T15:08:17.161+0200;VM;-;;ALARM - VM;-;M6 - Transaction 'TSS_AS2-3641-SPP_appName_9005_6666_1-RSS_PROD.1458652097.77-RECEIVED-0' received for card '12345.9998.67890' with unknown applicationIssuer/applicationOwner couple ([12345]/[9998]) Mar 22 13:08:17 hostname38 SYSLOG 7883 - - INFO;2016-03-22T15:08:17.130+0200;VM;-;;Transaction 'TSS_AS2-3641-SPP_appName_9005_6666_1-RSS_PROD.1458652097.76-RECEIVED-0' received for card '12345.9998.67890' with unknown applicationIssuer/applicationOwner couple ([12345]/[9998]);-;-;-;-;log.js;-;- Mar 22 13:08:17 hostname38 SYSLOG 7883 - - INFO;2016-03-22T15:08:17.161+0200;VM;-;;-;Transaction 'TSS_AS2-3641-SPP_appName_9005_6666_1-RSS_PROD.1458652097.77-RECEIVED-0' received for card '12345.9998.67890' with unknown applicationIssuer/applicationOwner couple ([12345]/[9998]);-;-;-;-;log.js;-;- Mar 22 13:08:17 hostname38 SYSLOG 7883 - - INFO;2016-03-22T15:08:17.147+0200;VM;-;;-;21,7,14,0,5,9;-;-;-;-;rest.js;-;- Mar 22 13:08:17 hostname38 SYSLOG 7883 - - INFO;2016-03-22T15:08:17.176+0200;VM;-;;-;21,8,13,0,3,10;-;-;-;-;rest.js;-;- Mar 22 13:08:18 hostname40 SYSLOG 7194 - - INFO;2016-03-22T15:08:18.159+0200;VM;-;Transaction 'TSS_AS2-3641-SPP_appName_9005_6666_1-RSS_PROD.1458652097.76' (counter: 3, sequence: 1), is next in line (case '9'), applied for card '12345.9998.67890' (counter: 2);-;-;-;-;nextInLineService.js;-;- Mar 22 13:08:18 hostname40 SYSLOG_ALARM 7194 - - INFO;2016-03-22T15:08:18.156+0200;VM;ALARM - VMM5 - Processing transaction 'TSS_AS2-3641-SPP_appName_9005_6666_1-RSS_PROD.1458652097.76-RECEIVED-0' for blacklisted card '12345.9998.67890' Mar 22 13:08:18 hostname40 SYSLOG_ALARM 7194 - - INFO;2016-03-22T15:08:18.159+0200;VM;EVENT - VMM5 - Processing transaction 'TSS_AS2-3641-SPP_appName_9005_6666_1-RSS_PROD.1458652097.76' for blacklisted card '12345.9998.67890' Mar 22 13:08:18 hostname40 SYSLOG 7194 - - INFO;2016-03-22T15:08:18.156+0200;VM;-;Processing transaction 'TSS_AS2-3641-SPP_appName_9005_6666_1-RSS_PROD.1458652097.76-RECEIVED-0' for blacklisted card '12345.9998.67890';-;-;-;-;log.js;-;- Mar 22 13:08:18 hostname40 SYSLOG 7194 - - INFO;2016-03-22T15:08:18.159+0200;VM;-;Processing transaction 'TSS_AS2-3641-SPP_appName_9005_6666_1-RSS_PROD.1458652097.76' for blacklisted card '12345.9998.67890';-;-;-;-;log.js;-;- Mar 22 13:08:18 hostname40 SYSLOG_ALARM 7194 - - INFO;2016-03-22T15:08:18.165+0200;VM;ALARM - VMM5 - Processing transaction 'TSS_AS2-3641-SPP_appName_9005_6666_1-RSS_PROD.1458652097.77-RECEIVED-0' for blacklisted card '12345.9998.67890' Mar 22 13:08:18 hostname40 SYSLOG 7194 - - INFO;2016-03-22T15:08:18.165+0200;VM;-;Processing transaction 'TSS_AS2-3641-SPP_appName_9005_6666_1-RSS_PROD.1458652097.77-RECEIVED-0' for blacklisted card '12345.9998.67890';-;-;-;-;log.js;-;- Mar 22 13:08:18 hostname40 SYSLOG 7194 - - INFO;2016-03-22T15:08:18.167+0200;VM;-;Processing transaction 'TSS_AS2-3641-SPP_appName_9005_6666_1-RSS_PROD.1458652097.77' for blacklisted card '12345.9998.67890';-;-;-;-;log.js;-;- Mar 22 13:08:18 hostname40 SYSLOG 7194 - - INFO;2016-03-22T15:08:18.167+0200;VM;-;Transaction 'TSS_AS2-3641-SPP_appName_9005_6666_1-RSS_PROD.1458652097.77' (counter: 3, sequence: 2 == number of transactions in sequence) is next in line, it is a case '4', applied for card '12345.9998.67890' (counter: 3);-;-;-;-;nextInLineService.js;-;- Mar 22 13:08:18 hostname40 SYSLOG 7194 - - INFO;2016-03-22T15:08:18.188+0200;VM;-;Transactions processed successfully (amount: regular - 2, from refresh migration - 0 , last processed transaction identifier: '352180');-;-;-;-;transactionRest.js;-;- Mar 22 13:08:18 hostname40 SYSLOG_ALARM 7194 - - INFO;2016-03-22T15:08:18.167+0200;VM;EVENT - VMM5 - Processing transaction 'TSS_AS2-3641-SPP_appName_9005_6666_1-RSS_PROD.1458652097.77' for blacklisted card '12345.9998.67890' ``` I have used redis input codecs: codec =\> multiline { pattern =\> "^\s" what =\> "previous" } Still its clubbing multiple logs in one message on Kibana. When I use this on local machine (windows) with LS 1.5.3, it works fine with same data. Difference is that, on local devlopment box, its file input and on test server, it's redis input. Please help how to resolve this? br, Sunil ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [March 22, 2016, 1:51pm UTC](https://discuss.elastic.co/t/multiline-codec-filter-not-working/45110/2 "2016-03-22T13:51:12Z")
So what does a multiline message look like? Your example above only contains single-line messages. Using the multiline codec with a redis input is a really bad idea. You want the multiline codec as close to the source as possible. ---
**Author:** ![sunilmchaudhari](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sunilmchaudhari/32/9475_2.png) [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\ **Post date:** [March 22, 2016, 1:56pm UTC](https://discuss.elastic.co/t/multiline-codec-filter-not-working/45110/3 "2016-03-22T13:56:00Z")
> So what does a multiline message look like? Your example above only contains single-line messages. > Even if those looks single line, those messages are coming in one record in kibana. I want those to separate. > There is something (\n like thing) which putting it in single message in kibana. Can you please explore your quotes? > Using the multiline codec with a redis input is a really bad idea. You want the multiline codec as close to the source as possible. br, Sunil ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:05am UTC](https://discuss.elastic.co/t/multiline-codec-filter-not-working/45110/4 "2017-07-06T05:05:54Z")