# Multiline codec is not breaking messages correctly

**URL:** <https://discuss.elastic.co/t/multiline-codec-is-not-breaking-messages-correctly/213460>\
**Category:** Logstash\
**Created:** [December 31, 2019, 3:10pm UTC](https://discuss.elastic.co/t/multiline-codec-is-not-breaking-messages-correctly/213460 "2019-12-31T15:10:04Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![sparkblaze](https://avatars.discourse-cdn.com/v4/letter/s/f9ae1b/32.png) [@sparkblaze](https://discuss.elastic.co/u/sparkblaze)\
**Post date:** [December 31, 2019, 3:10pm UTC](https://discuss.elastic.co/t/multiline-codec-is-not-breaking-messages-correctly/213460/1 "2019-12-31T15:10:05Z")

</div>

Afternoon,

I'm having some issues with the multiline codec config and it adding events to the previous message so not being very helpful.

in logstash I have the following input definition

```
syslog {
        id => "input-syslog"
        port => 5140
        type => "syslog"
        codec => multiline {
            patterns_dir => ["/etc/logstash/conf.d/patterns.d"]
            pattern => "(^%{SYSLOGBASE})|(^%{SYSLOGBASE_RFC5424})|(Udp data)"
            negate => true
            what => "previous"
        }
        add_field => { "[logstash][host][name]" => "${LOGSTASH_HOSTNAME}" }
}

```

This seems to be working for some systems that throw a stack trace via syslog occasionally and where RFC5424 messages are sent (they always appear as a single event), but it doesn't appear to like the %{SYSLOGBASE} messages.

So I'm getting those types of messages rolled up

For example:

> \<134\> 12/31/2019:15:01:32 GMT LB-TST-VPX01 0-PPE-0 : default EVENT MONITORUP 17181 0 : Monitor DBSMonServiceBinding\_log-collectors-syslog:514\_(tcp-default)(#syslog-internal\_service-log-collectors-syslog  
> \<134\> 12/31/2019:15:01:40 GMT LB-TST-VPX01 0-PPE-0 : default GUI CMD\_EXECUTED 17184 0 : User sparkblaze - Remote\_ip 192.168.100.6 - Command "show ns config" - Status "Success"

Have I missed something obvious that I can't see at the moment?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 28, 2020, 3:10pm UTC](https://discuss.elastic.co/t/multiline-codec-is-not-breaking-messages-correctly/213460/2 "2020-01-28T15:10:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.