# Multiline filter in logstash 5.5

**URL:** <https://discuss.elastic.co/t/multiline-filter-in-logstash-5-5/96832>\
**Category:** Logstash\
**Created:** [August 12, 2017, 4:07am UTC](https://discuss.elastic.co/t/multiline-filter-in-logstash-5-5/96832 "2017-08-12T04:07:21Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![aliyesami](https://avatars.discourse-cdn.com/v4/letter/a/ecb155/32.png) [@aliyesami](https://discuss.elastic.co/u/aliyesami)\
**Post date:** [August 12, 2017, 4:07am UTC](https://discuss.elastic.co/t/multiline-filter-in-logstash-5-5/96832/1 "2017-08-12T04:07:21Z")

</div>

I am unable to find any example or document giving example of it , this code is from 2.4 version , what would be the equivalent in 5.5 ? I have tried "codec =\> multiline" but it gives syntax error in the "filter" section , it does work though in the "input" section.

> filter (  
> multiline {  
> pattern =\> "%{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{YEAR}"  
> negate =\> true  
> what =\> “previous”  
> }

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 13, 2017, 6:52pm UTC](https://discuss.elastic.co/t/multiline-filter-in-logstash-5-5/96832/2 "2017-08-13T18:52:20Z")

</div>

The multiline filter has been deprecated. Use the multiline codec instead. There's an example in the multiline codec documentation.

---

<div class="post-metadata">

**Author:** ![aliyesami](https://avatars.discourse-cdn.com/v4/letter/a/ecb155/32.png) [@aliyesami](https://discuss.elastic.co/u/aliyesami)\
**Post date:** [August 14, 2017, 1:34pm UTC](https://discuss.elastic.co/t/multiline-filter-in-logstash-5-5/96832/3 "2017-08-14T13:34:15Z")

</div>

yes I read that document and its was not clear to me how to use the new method , Is the filteration part moved to the input section like below ?

> input (  
> codec =\> multiline {  
> pattern =\> "%{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{YEAR}"  
> negate =\> true  
> what =\> “previous”  
> }

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 14, 2017, 2:00pm UTC](https://discuss.elastic.co/t/multiline-filter-in-logstash-5-5/96832/4 "2017-08-14T14:00:36Z")

</div>

Yes.

---

<div class="post-metadata">

**Author:** ![aliyesami](https://avatars.discourse-cdn.com/v4/letter/a/ecb155/32.png) [@aliyesami](https://discuss.elastic.co/u/aliyesami)\
**Post date:** [August 14, 2017, 2:24pm UTC](https://discuss.elastic.co/t/multiline-filter-in-logstash-5-5/96832/5 "2017-08-14T14:24:47Z")

</div>

then can you please take a look at my other post since I did exactly that but its creating two indexes and also other issues I have pointed out in my post

[https://discuss.elastic.co/t/logstash-5-5-1-index-creation-issue/96828](https://discuss.elastic.co/t/logstash-5-5-1-index-creation-issue/96828)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 11, 2017, 2:25pm UTC](https://discuss.elastic.co/t/multiline-filter-in-logstash-5-5/96832/6 "2017-09-11T14:25:02Z")

</div>

Closed on September 11, 2017, 2:25pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.