# Multiline Config from LS1.5.4 not working in LS2.0.0

**URL:** https://discuss.elastic.co/t/multiline-config-from-ls1-5-4-not-working-in-ls2-0-0/35086
**Category:** Logstash
**Created:** [November 19, 2015, 9:32pm UTC](https://discuss.elastic.co/t/multiline-config-from-ls1-5-4-not-working-in-ls2-0-0/35086 "2015-11-19T21:32:19Z")
**Posts on this page:** 9
**Page:** 1

<div class="post-metadata">

### Author: ![mad\_min](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mad_min/32/5964_2.png) [@mad\_min](https://discuss.elastic.co/u/mad_min)
#### Post date: [November 19, 2015, 9:32pm UTC](https://discuss.elastic.co/t/multiline-config-from-ls1-5-4-not-working-in-ls2-0-0/35086/1 "2015-11-19T21:32:19Z")

</div>

Hi LS community,

I am trying to migrate my LS setup from 1.5.4 (which doesnt seem to be happy with ES2.0.0) over to LS 2.0.0. Everything is the same except the change from 'host' --\> 'hosts'.

However, I am not able to start LS because of this:

Error: Cannot use more than 1 filter worker because the following plugins don't work with more than one worker: multiline, multiline

The same config works fine for LS1.5.4. I have several conditional 'multilines' in the filter section.

Thoughts?

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [November 20, 2015, 3:36am UTC](https://discuss.elastic.co/t/multiline-config-from-ls1-5-4-not-working-in-ls2-0-0/35086/2 "2015-11-20T03:36:44Z")

</div>

Using multiple workers with multiline can be dangerous as you can end up splitting messages.

It does mention it here [https://www.elastic.co/guide/en/logstash/current/plugins-filters-multiline.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-multiline.html) and also [https://www.elastic.co/guide/en/logstash/1.5/plugins-filters-multiline.html](https://www.elastic.co/guide/en/logstash/1.5/plugins-filters-multiline.html).  
Are you sure this worked in 1.5?

---

<div class="post-metadata">

### Author: ![mad\_min](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mad_min/32/5964_2.png) [@mad\_min](https://discuss.elastic.co/u/mad_min)
#### Post date: [November 20, 2015, 2:41pm UTC](https://discuss.elastic.co/t/multiline-config-from-ls1-5-4-not-working-in-ls2-0-0/35086/3 "2015-11-20T14:41:06Z")

</div>

Thanks for replying @warkolm

I was not using multiple workers in 1.5.4. I did try passing the parameter, but it had refused it. So there were no multiple workers for multiline in 1.5.4 and that was working with multiple multilines.

In 2.0.0, I am not passing any multiple worker flag either. Maybe there is a new default in 2.0 that gets passed for multiple workers?

Thanks.

---

<div class="post-metadata">

### Author: ![jcollie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jcollie/32/567_2.png) [@jcollie](https://discuss.elastic.co/u/jcollie)
#### Post date: [November 20, 2015, 4:23pm UTC](https://discuss.elastic.co/t/multiline-config-from-ls1-5-4-not-working-in-ls2-0-0/35086/4 "2015-11-20T16:23:20Z")

</div>

FYI, I found this:

> <https://github.com/logstash-plugins/logstash-input-beats/issues/24>

---

<div class="post-metadata">

### Author: ![mad\_min](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mad_min/32/5964_2.png) [@mad\_min](https://discuss.elastic.co/u/mad_min)
#### Post date: [November 20, 2015, 4:29pm UTC](https://discuss.elastic.co/t/multiline-config-from-ls1-5-4-not-working-in-ls2-0-0/35086/5 "2015-11-20T16:29:38Z")

</div>

Thanks @jcollie.

So far, I am not able to see whether I will have an issue with multiline and LS2.0. Thats because I cant get LS2.0 to start up. 😄  
The issue is, (i think) LS2.0 is trying to startup with multiple

- workers

(by default i guess), but because I have multilines, startup is failing. This behavior is known of course as mentioned by @warkolm.

The questions i guess are:

1. Does LS2.0 startup with multiple workers by default?
2. If not #1, then why does LS2.0 think I am trying to startup with multiple workers? (because I am not)

Thanks!

---

<div class="post-metadata">

### Author: ![jcollie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jcollie/32/567_2.png) [@jcollie](https://discuss.elastic.co/u/jcollie)
#### Post date: [November 20, 2015, 4:33pm UTC](https://discuss.elastic.co/t/multiline-config-from-ls1-5-4-not-working-in-ls2-0-0/35086/6 "2015-11-20T16:33:26Z")

</div>

Despite what the documentation claims, I'm pretty sure that Logstash 2.x starts up with multiple filter workers. Try adding "-w 1" to your command line and see if that helps.

---

<div class="post-metadata">

### Author: ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)
#### Post date: [November 20, 2015, 4:56pm UTC](https://discuss.elastic.co/t/multiline-config-from-ls1-5-4-not-working-in-ls2-0-0/35086/7 "2015-11-20T16:56:56Z")

</div>

Logstash 2.0 does, indeed, start with what is effectively `-w #_of_cores/2`

We've found that this causes issues with some plugins (multiline filter, specifically), so this is being addressed for the next release.

Feel free to launch with `-w 1` in the meanwhile.

---

<div class="post-metadata">

### Author: ![mad\_min](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mad_min/32/5964_2.png) [@mad\_min](https://discuss.elastic.co/u/mad_min)
#### Post date: [November 20, 2015, 6:49pm UTC](https://discuss.elastic.co/t/multiline-config-from-ls1-5-4-not-working-in-ls2-0-0/35086/8 "2015-11-20T18:49:28Z")

</div>

Thanks @jcollie and @theuntergeek.

Common sense is the most uncommon. I should have just tried with -w 1.

This worked indeed!

Thanks.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:21am UTC](https://discuss.elastic.co/t/multiline-config-from-ls1-5-4-not-working-in-ls2-0-0/35086/9 "2017-07-06T05:21:58Z")

</div>


