# Multiline Codec logstash for log level **URL:** \ **Category:** Logstash\ **Created:** [July 31, 2019, 10:32am UTC](https://discuss.elastic.co/t/multiline-codec-logstash-for-log-level/193094 "2019-07-31T10:32:01Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![mvenkat\_in](https://avatars.discourse-cdn.com/v4/letter/m/58f4c7/32.png) [@mvenkat\_in](https://discuss.elastic.co/u/mvenkat_in)\ **Post date:** [July 31, 2019, 10:32am UTC](https://discuss.elastic.co/t/multiline-codec-logstash-for-log-level/193094/1 "2019-07-31T10:32:01Z")
Hi I have a log entry sample as below. every line starts with i.e., log level. Few log entries would be on the same line but few would be in multiple lines. Can you please suggest the logstash file input multiline code pattern for this. Sample: [TRACE] [2019-07-31 10:31:38,889] ...................................................................................................................................................\\] [INFO] [2019-07-31 10:31:38,889] ...................................................................................................................................................\\] ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [July 31, 2019, 12:21pm UTC](https://discuss.elastic.co/t/multiline-codec-logstash-for-log-level/193094/2 "2019-07-31T12:21:07Z")
Try ``` multiline { pattern => "^\[%{LOGLEVEL}\]" negate => true what => previous auto_flush_interval => 1 } ``` ---
**Author:** ![mvenkat\_in](https://avatars.discourse-cdn.com/v4/letter/m/58f4c7/32.png) [@mvenkat\_in](https://discuss.elastic.co/u/mvenkat_in)\ **Post date:** [July 31, 2019, 4:55pm UTC](https://discuss.elastic.co/t/multiline-codec-logstash-for-log-level/193094/3 "2019-07-31T16:55:53Z")
Hi Unfortunately I realized that the file log line starts with some anscii color sequences/ESC characters as below **ESC[mESC[32m**[INFO][2019-07-31 10:31:38,889]................................................................ Please suggest what should be the pattern Note: The logstash grok parse failure log shows the above ESC characters as below **\u001B[m\u001B[35m**[INFO][2019-07-31 10:31:38,889]................................................................ Thanks ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [July 31, 2019, 5:35pm UTC](https://discuss.elastic.co/t/multiline-codec-logstash-for-log-level/193094/4 "2019-07-31T17:35:19Z")
I am not feeling up to writing a regexp that matches arbitrary ISO 6429 sequences, but if all you need to handle is SGRs then this would work ``` multiline { pattern => "^(^[\[[0-9]*m)*\[%{LOGLEVEL}\]" negate => true what => previous auto_flush_interval => 1 } } ``` Note that the ^[ is a literal escape character. That results in ``` "message" => "\e[m\e[32m[TRACE] [2019-07-31 10:31:38,889] ...................................................................................................................................................]", ``` ---
**Author:** ![mvenkat\_in](https://avatars.discourse-cdn.com/v4/letter/m/58f4c7/32.png) [@mvenkat\_in](https://discuss.elastic.co/u/mvenkat_in)\ **Post date:** [August 1, 2019, 4:09am UTC](https://discuss.elastic.co/t/multiline-codec-logstash-for-log-level/193094/5 "2019-08-01T04:09:35Z")
Got the following error from logstash and exited. [2019-08-01T04:35:39,283][ERROR][logstash.agent] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"RegexpError", :message=\>"premature end of char-class: /^(^[\[[0-9]_m)_\[(?([Aa]lert|ALERT|[Tt]race|TRACE|[Dd]ebug|DEBUG|[Nn]otice|NOTICE|[Ii]nfo|INFO|[Ww]arn?(?:ing)?|WARN?(?:ING)?|[Ee]rr?(?:or)?|ERR?(?:OR)?|[Cc]rit?(?:ical)?|CRIT?(?:ICAL)?|[Ff]atal|FATAL|[Ss]evere|SEVERE|EMERG(?:ENCY)?|[Ee]merg(?:ency)?))\]/m", :backtrace=\>["org/jruby/RubyRegexp.java:940:in `initialize'", "/home/hybrisuser/elk/logstash-7.2.0/vendor/bundle/jruby/2.5.0/gems/jls-grok-0.11.5/lib/grok-pure.rb:127:in`compile'", "/home/hybrisuser/elk/logstash-7.2.0/vendor/bundle/jruby/2.5.0/gems/logstash-codec-multiline-3.0.10/lib/logstash/codecs/multiline.rb:166:in `register'", "/home/hybrisuser/elk/logstash-7.2.0/logstash-core/lib/logstash/codecs/base.rb:18:in`initialize'", "org/logstash/plugins/PluginFactoryExt.java:258:in `plugin'", "org/logstash/execution/JavaBasePipelineExt.java:50:in`initialize'", "/home/hybrisuser/elk/logstash-7.2.0/logstash-core/lib/logstash/java\_pipeline.rb:24:in `initialize'", "/home/hybrisuser/elk/logstash-7.2.0/logstash-core/lib/logstash/pipeline_action/create.rb:36:in`execute'", "/home/hybrisuser/elk/logstash-7.2.0/logstash-core/lib/logstash/agent.rb:325:in `block in converge\_state'"]} ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 1, 2019, 11:23am UTC](https://discuss.elastic.co/t/multiline-codec-logstash-for-log-level/193094/6 "2019-08-01T11:23:48Z")
> [@mvenkat\_in](#): > > premature end of char-class That suggests that you have entered ^[ as a caret and a square bracket instead of a literal escape character (ctrl/v+esc on UNIX). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 29, 2019, 11:23am UTC](https://discuss.elastic.co/t/multiline-codec-logstash-for-log-level/193094/7 "2019-08-29T11:23:53Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.