# Multiline concat order

**URL:** <https://discuss.elastic.co/t/multiline-concat-order/96570>\
**Category:** Logstash\
**Created:** [August 10, 2017, 8:38am UTC](https://discuss.elastic.co/t/multiline-concat-order/96570 "2017-08-10T08:38:11Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Blu3](https://avatars.discourse-cdn.com/v4/letter/b/258eb7/32.png) [@Blu3](https://discuss.elastic.co/u/Blu3)\
**Post date:** [August 10, 2017, 8:38am UTC](https://discuss.elastic.co/t/multiline-concat-order/96570/1 "2017-08-10T08:38:11Z")

</div>

I'm using multiline codec to file input plugin with following configuration:

```
pattern => "^%{DATESTAMP}\s{2}"
negate => true
what => previous

```

So it should append line to a previous entry if there are no two whitespaces after the datestamp.  
The problem is in appending order because message looks like this:

```
r.GetContextRequest(SPRequestAuthenticationMode authenticationMode) at Microsoft.SharePoint.Administration.SPFarm.get_RequestAny() at Microsoft.SharePoint.Utilities.SPPerformanceCounterAgent.UpdateSharePointPerfmonCounters()	 
,
Unable to update the value of a system performance counter. The following exception was thrown: System.Runtime.InteropServices.COMException (0x800703FA): Retrieving the COM class factory for component with CLSID {BDEADF26-C265-11D0-BCED-00A0C90AB50F} failed due to the following error: 800703fa Illegal operation attempted on a registry key that has been marked for deletion. (Exception from HRESULT: 0x800703FA). at Microsoft.SharePoint.Library.SPRequest..ctor() at Microsoft.SharePoint.SPGlobal.CreateSPRequestAndSetIdentity(SPSite site, String name, Boolean bNotGlobalAdminCode, String strUrl, Boolean bNotAddToContext, Byte[] UserToken, SPAppPrincipalToken appPrincipalToken, String userName, Boolean bIgnoreTokenTimeout, Boolean bAsAnonymous) at Microsoft.SharePoint.SPRequestManage

```

The first line should be last in this case. Is there any way to append previous log message to the beginning instead of appending to the end?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 7, 2017, 8:38am UTC](https://discuss.elastic.co/t/multiline-concat-order/96570/2 "2017-09-07T08:38:31Z")

</div>

Closed on September 7, 2017, 8:38am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.