# Multiline doesn't read last line

**URL:** https://discuss.elastic.co/t/multiline-doesnt-read-last-line/80621
**Category:** Logstash
**Created:** [March 30, 2017, 8:18am UTC](https://discuss.elastic.co/t/multiline-doesnt-read-last-line/80621 "2017-03-30T08:18:12Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![bertvervaele](https://avatars.discourse-cdn.com/v4/letter/b/8e7dd6/32.png) [@bertvervaele](https://discuss.elastic.co/u/bertvervaele)
#### Post date: [March 30, 2017, 8:18am UTC](https://discuss.elastic.co/t/multiline-doesnt-read-last-line/80621/1 "2017-03-30T08:18:12Z")

</div>

I know this is a known problem but I can't find I there is already a solution to it.  
So I want to read the oracle log file. This looks like this:

```
Sat Apr 09 10:13:17 2016
Archived Log entry 24018 added for thread 1 sequence 24444 ID 0xa5d45fc6 dest 1:
Sat Apr 09 10:18:05 2016
Completed checkpoint up to RBA [0x5f7d.2.10], SCN: 5443782313
Sat Apr 09 10:23:35 2016
Beginning log switch checkpoint up to RBA [0x5f7e.2.10], SCN: 5443860599
Thread 1 advanced to log sequence 24446 (LGWR switch)
  Current log# 2 seq# 24446 mem# 0: /oracle/PER/origlogB/log_g12m1.dbf
  Current log# 2 seq# 24446 mem# 1: /oracle/PER/mirrlogB/log_g12m2.dbf

```

my code:

```
input {
    file {
        path => "/oracle/FDG/saptrace/diag/rdbms/fdg/FDG/trace/alert_FDG.log"
        codec => multiline {
            pattern => "%{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{YEAR}"
            negate => true
            what => "previous"
        }
    }
}

```

So the amount of lines is not always the same.  
Is there another way to read the last line(s)?

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [March 30, 2017, 8:36am UTC](https://discuss.elastic.co/t/multiline-doesnt-read-last-line/80621/2 "2017-03-30T08:36:27Z")

</div>

[https://www.elastic.co/guide/en/logstash/current/plugins-codecs-multiline.html#plugins-codecs-multiline-auto\_flush\_interval](https://www.elastic.co/guide/en/logstash/current/plugins-codecs-multiline.html#plugins-codecs-multiline-auto_flush_interval) might be what you want.

---

<div class="post-metadata">

### Author: ![bertvervaele](https://avatars.discourse-cdn.com/v4/letter/b/8e7dd6/32.png) [@bertvervaele](https://discuss.elastic.co/u/bertvervaele)
#### Post date: [March 30, 2017, 8:43am UTC](https://discuss.elastic.co/t/multiline-doesnt-read-last-line/80621/3 "2017-03-30T08:43:28Z")

</div>

Thank you for the quick answer.  
auto\_flush\_interval was indeed what I needed 🙂

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 27, 2017, 8:43am UTC](https://discuss.elastic.co/t/multiline-doesnt-read-last-line/80621/4 "2017-04-27T08:43:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.