# Multiline Codec Issues
**URL:** https://discuss.elastic.co/t/multiline-codec-issues/47170
**Category:** Logstash
**Created:** [April 12, 2016, 9:34pm UTC](https://discuss.elastic.co/t/multiline-codec-issues/47170 "2016-04-12T21:34:19Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Maxwell\_Flanders](https://discuss.elastic.co/u/Maxwell_Flanders)
#### Post date: [April 12, 2016, 9:34pm UTC](https://discuss.elastic.co/t/multiline-codec-issues/47170/1 "2016-04-12T21:34:19Z")
So for example, if I have a BASIC stack trace like this:
Caused by: java.lang.IllegalArgumentException: field [@timestamp] doesn't exist
at org.elasticsearch.action.fieldstats.TransportFieldStatsTransportAction.shardOperation(TransportFieldStatsTransportAction.java:166)
and this config
input {
some\_input {
some\_settings
codec =\> multiline {
source =\> "message"
pattern =\> "^\s"
what =\> "previous"
}
}
}
filter {
mutate {
gsub =\> ["message", "field", "SOMESTRING"]
}
}
output {
some\_output { }
}
I understand that, the word "field" in the FIRST line would be substituted out for SOMESTRING, but when the second line enters your logstash pipeline and hits the multiline codec, it would return a match, and then be added to the previous event. Would that data then make it through the rest of the logstash pipeline?? Wouldn't the first event have passed through the mutate filter?? Would the data be appended to the message field?? I'm just not clear on how this interaction works. Thank you!!
---
### Author:  [@Maxwell\_Flanders](https://discuss.elastic.co/u/Maxwell_Flanders)
#### Post date: [April 12, 2016, 9:34pm UTC](https://discuss.elastic.co/t/multiline-codec-issues/47170/2 "2016-04-12T21:34:56Z")
Pretend there was a tab in front of the "at" in the second line of that stack trace. Formatting problems. \>:(
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [April 13, 2016, 1:10am UTC](https://discuss.elastic.co/t/multiline-codec-issues/47170/3 "2016-04-13T01:10:43Z")
I've moved this to the Logstash category for you 🙂
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [April 13, 2016, 5:49am UTC](https://discuss.elastic.co/t/multiline-codec-issues/47170/4 "2016-04-13T05:49:42Z")
> Would that data then make it through the rest of the logstash pipeline??
Yes.
> Wouldn't the first event have passed through the mutate filter??
No. The multiline buffers input physical lines until it concludes that the current event should be released.
> Would the data be appended to the message field??
Yes. What you'll get in the end is one event with a `message` field containing "Caused by: java.lang.IllegalArgumentException: field [@timestamp] doesn't exist\n\tat org.elasticsearch.action.fieldstats.TransportFieldStatsTransportAction.shardOperation(TransportFieldStatsTransportAction.java:166)".
I'm not sure you have the best pattern though. Doesn't your log messages begin with a timestamp? The typical way to configure a multiline codec for log files with potentially multiline events is this:
```auto
multiline {
pattern => "^some regexp that matches the timestamp"
negate => true
what => "previous"
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:02am UTC](https://discuss.elastic.co/t/multiline-codec-issues/47170/5 "2017-07-06T05:02:34Z")