# Multiline codec in input

**URL:** https://discuss.elastic.co/t/multiline-codec-in-input/59451
**Category:** Logstash
**Created:** [August 31, 2016, 5:07pm UTC](https://discuss.elastic.co/t/multiline-codec-in-input/59451 "2016-08-31T17:07:50Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![rmalired](https://avatars.discourse-cdn.com/v4/letter/r/e495f1/32.png) [@rmalired](https://discuss.elastic.co/u/rmalired)
#### Post date: [August 31, 2016, 5:07pm UTC](https://discuss.elastic.co/t/multiline-codec-in-input/59451/1 "2016-08-31T17:07:50Z")

</div>

I have a scenario where filebeat send information from access.log as well as application.log. The application log can be multiline.

so in the logstash.conf i have a multiline codec looking for a timestamp as the pattern.

input {

```
beats {
 type => beats
 port => 5044
     codec => multiline{
      pattern => "(^\<%{MONTHDAY}\s%{MONTH}\s%{YEAR}\s%{HOUR}:%{MINUTE}:%{SECOND}\>)"
      negate => true
      what => "previous"
     }

```

}  
}

but the access.log starts with IP address when I ingest access.log data to logstash it treats all the lines into one message

 ![](https://us1.discourse-cdn.com/elastic/original/2X/0/07f77d889b89cdd1cd5e9e5d25529bf7e515ebb1.png)

what is the best solution for this kind of situation

I see couple of pointers

> [@Mixed JSON input and Other Log files with Multiline codec](https://discuss.elastic.co/t/mixed-json-input-and-other-log-files-with-multiline-codec/36696/2):
>
> It's pretty clear that your current multiline pattern won't work for JSON lines that begin with a curly brace. Would changing the pattern to e.g. ^(\d+|\{") help?

or use

filebeat multiline, I don't want to do this approach because I have lot of harvesters on application log files (20 micro services deployed on a single container)

thanks  
rakesh

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [September 1, 2016, 11:48pm UTC](https://discuss.elastic.co/t/multiline-codec-in-input/59451/2 "2016-09-01T23:48:36Z")

</div>

> [@rmalired](#):
>
> or use
> 
> filebeat multiline

This is the best option.

> [@rmalired](#):
>
> I don't want to do this approach because I have lot of harvesters on application log files (20 micro services deployed on a single container)

You don't have automation to handle it?

---

<div class="post-metadata">

### Author: ![rmalired](https://avatars.discourse-cdn.com/v4/letter/r/e495f1/32.png) [@rmalired](https://discuss.elastic.co/u/rmalired)
#### Post date: [September 3, 2016, 4:17pm UTC](https://discuss.elastic.co/t/multiline-codec-in-input/59451/3 "2016-09-03T16:17:46Z")

</div>

Mark,

Ended up using multiline filebeat.

Automation is there, My only concern was how much additional cpu and memory will be consumed by filebeat, if I put the multiline logic onto the client machine.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:40am UTC](https://discuss.elastic.co/t/multiline-codec-in-input/59451/4 "2017-07-06T04:40:03Z")

</div>