# Multiline Codec Not Retrieving Any Data

**URL:** <https://discuss.elastic.co/t/multiline-codec-not-retrieving-any-data/73240>\
**Category:** Logstash\
**Created:** [January 30, 2017, 4:16pm UTC](https://discuss.elastic.co/t/multiline-codec-not-retrieving-any-data/73240 "2017-01-30T16:16:45Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![seth.yes](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/seth.yes/32/11788_2.png) [@seth.yes](https://discuss.elastic.co/u/seth.yes)\
**Post date:** [January 30, 2017, 4:16pm UTC](https://discuss.elastic.co/t/multiline-codec-not-retrieving-any-data/73240/1 "2017-01-30T16:16:45Z")

</div>

I'm using the Multiline codec with the File input in hopes to retrieve multiline log files from a file that is being populated on the same box I'm running Logstash (v5.1.2) & Elasticsearch (v.2.4.2).

I've isolated just the input and output config in order to minimize the variables that could be affecting the desired performance.

```
input {
  file {
    path => "/var/log/cluster/cluster.log"
    start_position => beginning
    codec => multiline {
      pattern => "0x7fff"
      what => "previous"
      auto_flush_interval => 3
    }
  }
}

output {
  elasticsearch {
    hosts => ["localhost:9200", "remotehost:9200"]
# sniffing => true
    manage_template => false
    index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
    document_type => "%{[@metadata][type]}"
  }
}

```

And an example of the multiline data populating the cluster.log file;

```
active node table
-------------------
pkey vlan master-s/n gateway-s/n gateway-prio if-name gateway name advertised ip
  0x7fff 0 0xa0640 0xa0640 100 if0 Switch-22-io 10.191.144.48
  0x7fff 0 0xa0640 0xa0400 100 if0 Switch-28-io 10.191.144.50
  0x7fff 0 0xa0640 0xa0180 100 if0 Switch-21-io 10.191.144.44
  0x7fff 0 0xa0640 0xa0140 100 if0 Switch-3-io 10.191.144.40
  0x7fff 0 0xa0640 0xa0100 100 if0 Switch-27-io 10.191.144.46
  0x7fff 0 0xa0640 0xa0080 100 if0 Switch-12-io 10.191.144.43
  0x7fff 0 0xa0640 0xa0040 100 if0 Switch-30-io 10.191.144.47
  0x7fff 0 0xa0640 0xa0000 100 if0 Switch-6-io 10.191.144.41
  0x7fff 0 0xa0640 0x9d340 100 if0 Switch-6-io 10.191.144.28

```

Any thoughts on what might be stopping this from working? A similar config was working with the multiline filter, however in an attempt to get more-consistent results, I decided to start using the multiline codec, however I've not got any results since the change. Furthermore, the logs aren't populating any useful data, thus further complicating debugging.

![](https://us1.discourse-cdn.com/elastic/original/2X/8/806c61612683ccbf28285164e9a890d3a0315c80.png)

Any issues anyone sees with my config? How would you go about debugging this issue? Thanks for any help.

---

<div class="post-metadata">

**Author:** ![seth.yes](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/seth.yes/32/11788_2.png) [@seth.yes](https://discuss.elastic.co/u/seth.yes)\
**Post date:** [January 30, 2017, 11:12pm UTC](https://discuss.elastic.co/t/multiline-codec-not-retrieving-any-data/73240/2 "2017-01-30T23:12:35Z")

</div>

I was able to get this filter working by starting logstash via the command:

```
sudo -u logstash /usr/share/logstash/bin/logstash -f /etc/logstash/conf.d --path.settings /etc/logstash &

```

I had to use this exact syntax, [found here](http://pradyumnajoshi.blogspot.com/2017/01/logstash-error-error-statuslogger-no.html), else I'd run into a whole slew of errors when attempting to start Logstash. Now I'm getting Grok timeouts but at least logstash is running and the multiline codec works, albeit appears as a duct tape and shoe string solution.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 27, 2017, 11:12pm UTC](https://discuss.elastic.co/t/multiline-codec-not-retrieving-any-data/73240/3 "2017-02-27T23:12:37Z")

</div>

Closed on February 27, 2017, 11:12pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.