# Multiline codec not picking up custom patterns

**URL:** <https://discuss.elastic.co/t/multiline-codec-not-picking-up-custom-patterns/189426>\
**Category:** Logstash\
**Created:** [July 8, 2019, 8:14pm UTC](https://discuss.elastic.co/t/multiline-codec-not-picking-up-custom-patterns/189426 "2019-07-08T20:14:34Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sous\_Lesquels](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sous_lesquels/32/41843_2.png) [@Sous\_Lesquels](https://discuss.elastic.co/u/Sous_Lesquels)\
**Post date:** [July 8, 2019, 8:14pm UTC](https://discuss.elastic.co/t/multiline-codec-not-picking-up-custom-patterns/189426/1 "2019-07-08T20:14:34Z")

</div>

With this config:

```
input {
   file {
      codec => multiline {
        ...
        patterns_dir => [
          '/path/to/patterns'
        ]
        ...
      }
   }
}

```

and the existing / readable file:

```
/path/to/patterns/file

```

that contains user patterns, I'm getting this:

```
[DEBUG][logstash.config.source.local.configpathloader] Skipping the following files while reading config since they don't match the specified glob pattern {:files=>["/path/to/patterns"]}

```

The patterns file does not get picked up at all, everything else is from logstash-patterns-core-4.1.2:

```
[DEBUG][logstash.codecs.multiline] Grok loading patterns from file {:path=>"/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-patterns-core-4.1.2/patterns/haproxy"}
[DEBUG][logstash.codecs.multiline] Grok loading patterns from file {:path=>"/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-patterns-core-4.1.2/patterns/bro"}
[DEBUG][logstash.codecs.multiline] Grok loading patterns from file {:path=>"/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-patterns-core-4.1.2/patterns/exim"}
[DEBUG][logstash.codecs.multiline] Grok loading patterns from file {:path=>"/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-patterns-core-4.1.2/patterns/aws"}
[DEBUG][logstash.codecs.multiline] Grok loading patterns from file {:path=>"/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-patterns-core-4.1.2/patterns/bacula"}
[DEBUG][logstash.codecs.multiline] Grok loading patterns from file {:path=>"/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-patterns-core-4.1.2/patterns/postgresql"}
[DEBUG][logstash.codecs.multiline] Grok loading patterns from file {:path=>"/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-patterns-core-4.1.2/patterns/redis"}
[DEBUG][logstash.codecs.multiline] Grok loading patterns from file {:path=>"/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-patterns-core-4.1.2/patterns/squid"}
[DEBUG][logstash.codecs.multiline] Grok loading patterns from file {:path=>"/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-patterns-core-4.1.2/patterns/nagios"}
[DEBUG][logstash.codecs.multiline] Grok loading patterns from file {:path=>"/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-patterns-core-4.1.2/patterns/mcollective"}
[DEBUG][logstash.codecs.multiline] Grok loading patterns from file {:path=>"/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-patterns-core-4.1.2/patterns/rails"}
[DEBUG][logstash.codecs.multiline] Grok loading patterns from file {:path=>"/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-patterns-core-4.1.2/patterns/grok-patterns"}
[DEBUG][logstash.codecs.multiline] Grok loading patterns from file {:path=>"/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-patterns-core-4.1.2/patterns/httpd"}
[DEBUG][logstash.codecs.multiline] Grok loading patterns from file {:path=>"/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-patterns-core-4.1.2/patterns/ruby"}
[DEBUG][logstash.codecs.multiline] Grok loading patterns from file {:path=>"/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-patterns-core-4.1.2/patterns/firewalls"}
[DEBUG][logstash.codecs.multiline] Grok loading patterns from file {:path=>"/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-patterns-core-4.1.2/patterns/mcollective-patterns"}
[DEBUG][logstash.codecs.multiline] Grok loading patterns from file {:path=>"/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-patterns-core-4.1.2/patterns/mongodb"}
[DEBUG][logstash.codecs.multiline] Grok loading patterns from file {:path=>"/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-patterns-core-4.1.2/patterns/java"}
[DEBUG][logstash.codecs.multiline] Grok loading patterns from file {:path=>"/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-patterns-core-4.1.2/patterns/maven"}
[DEBUG][logstash.codecs.multiline] Grok loading patterns from file {:path=>"/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-patterns-core-4.1.2/patterns/junos"}
[DEBUG][logstash.codecs.multiline] Grok loading patterns from file {:path=>"/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-patterns-core-4.1.2/patterns/bind"}

```

What am I doing wrong?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [July 8, 2019, 10:25pm UTC](https://discuss.elastic.co/t/multiline-codec-not-picking-up-custom-patterns/189426/2 "2019-07-08T22:25:27Z")

</div>

Rather than deleting your question, it would be better if you could share your solution, as it may help others in the future with a similar problem 🙂

---

<div class="post-metadata">

**Author:** ![Sous\_Lesquels](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sous_lesquels/32/41843_2.png) [@Sous\_Lesquels](https://discuss.elastic.co/u/Sous_Lesquels)\
**Post date:** [July 9, 2019, 2:38pm UTC](https://discuss.elastic.co/t/multiline-codec-not-picking-up-custom-patterns/189426/3 "2019-07-09T14:38:57Z")

</div>

@warkolm I deleted it because I changed the config and stopped before figuring out the problem. I wanted to spare others from wasting their time on this, hope that makes sense 🙂

This line was a red herring though:

```auto
[DEBUG][logstash.config.source.local.configpathloader] Skipping the following files while reading config since they don't match the specified glob pattern {:files=>["/path/to/patterns"]}

```

The above is for config-only loading looks like and doesn't seem to have anything to do with multiline codec, it just happened to be in the same folder as the config, which is what confused me.

Looking at the [code](https://github.com/logstash-plugins/logstash-codec-multiline/blob/f7715939c0d080a6f0e1c42c7cc994e921ff0217/lib/logstash/codecs/multiline.rb#L156) nothing more specific is logged in that case, i.e. the path is just ignored if it's not valid for any reason.

So most likely something I had wrong in the original config.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 9, 2019, 3:15pm UTC](https://discuss.elastic.co/t/multiline-codec-not-picking-up-custom-patterns/189426/4 "2019-07-09T15:15:02Z")

</div>

You were missing the trailing / on the value of patterns\_dir. It is not optional.

---

<div class="post-metadata">

**Author:** ![Sous\_Lesquels](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sous_lesquels/32/41843_2.png) [@Sous\_Lesquels](https://discuss.elastic.co/u/Sous_Lesquels)\
**Post date:** [July 9, 2019, 4:18pm UTC](https://discuss.elastic.co/t/multiline-codec-not-picking-up-custom-patterns/189426/5 "2019-07-09T16:18:56Z")

</div>

Got it, thanks @Badger - that might have been it then.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 4, 2022, 7:15am UTC](https://discuss.elastic.co/t/multiline-codec-not-picking-up-custom-patterns/189426/6 "2022-11-04T07:15:43Z")

</div>