### Author:  [@jetnet](https://discuss.elastic.co/u/jetnet)
#### Post date: [March 8, 2017, 8:18am UTC](https://discuss.elastic.co/t/multiline-filter-single-threaded/77783/1 "2017-03-08T08:18:06Z")
Hi All,
it looks like the multi-line filter cannot be used with more than one Logstash worker: I get the following error, when the Logstash gets started with `-w N` (N \> 1):
```
09:01:17.819 [[main]>worker0] ERROR logstash.pipeline - Exception in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash. {
"exception"=>#,
"backtrace"=>["C:/programs/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-multiline-3.0.2/lib/logstash/filters/multiline.rb:273:in `merge'",
"org/jruby/RubyArray.java:1613:in `each'",
"org/jruby/RubyEnumerable.java:852:in `inject'",
"C:/programs/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-multiline-3.0.2/lib/logstash/filters/multiline.rb:272:in `merge'",
"C:/programs/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-multiline-3.0.2/lib/logstash/filters/multiline.rb:230:in `previous_filter!'",
"C:/programs/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-multiline-3.0.2/lib/logstash/filters/multiline.rb:173:in `filter'",
"C:/programs/logstash/logstash-core/lib/logstash/filters/base.rb:145:in `do_filter'",
"C:/programs/logstash/logstash-core/lib/logstash/filters/base.rb:164:in `multi_filter'",
"org/jruby/RubyArray.java:1613:in `each'",
"C:/programs/logstash/logstash-core/lib/logstash/filters/base.rb:161:in `multi_filter'",
"C:/programs/logstash/logstash-core/lib/logstash/filter_delegator.rb:41:in `multi_filter'",
"(eval):303:in `filter_func'",
"C:/programs/logstash/logstash-core/lib/logstash/pipeline.rb:378:in `filter_batch'",
"org/jruby/RubyProc.java:281:in `call'",
"C:/programs/logstash/logstash-core/lib/logstash/util/wrapped_synchronous_queue.rb:201:in `each'",
"org/jruby/RubyHash.java:1342:in `each'",
"C:/programs/logstash/logstash-core/lib/logstash/util/wrapped_synchronous_queue.rb:200:in `each'",
"C:/programs/logstash/logstash-core/lib/logstash/pipeline.rb:377:in `filter_batch'",
"C:/programs/logstash/logstash-core/lib/logstash/pipeline.rb:365:in `worker_loop'",
"C:/programs/logstash/logstash-core/lib/logstash/pipeline.rb:331:in `start_workers'"]
}
```
the multi-line config:
```
multiline {
pattern => "^%{TIMESTAMP_ISO8601}\s+"
negate => true
what => "previous"
}
```
Env: Logstash v5.2.2 on windows 10
Has anyone else experienced similar problems?
Thank you!
---
### Author:  [@jetnet](https://discuss.elastic.co/u/jetnet)
#### Post date: [March 8, 2017, 8:32am UTC](https://discuss.elastic.co/t/multiline-filter-single-threaded/77783/2 "2017-03-08T08:32:06Z")
just adding some more details:
the logstash crashes not immediately, but after processing a couple of thousand log entries (~2000 - 12000...)
---
### Author:  [@jetnet](https://discuss.elastic.co/u/jetnet)
#### Post date: [March 8, 2017, 10:55am UTC](https://discuss.elastic.co/t/multiline-filter-single-threaded/77783/3 "2017-03-08T10:55:45Z")
**Workaround** (or maybe the preferred way?):
move the multi-line processing to `codecs`, e.g.:
```
input {
file {
path => "C:/log/**/*.log"
start_position => "beginning"
sincedb_path => "NUL"
ignore_older => 0
codec => multiline {
pattern => "^%{TIMESTAMP_ISO8601}\s+"
negate => true
what => previous
}
}
```
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [March 8, 2017, 1:18pm UTC](https://discuss.elastic.co/t/multiline-filter-single-threaded/77783/4 "2017-03-08T13:18:40Z")
There is a multiline filter (deprecated, and the one you initially specified) as well as a multiline codec (the recommended component to use), which you seem to be correctly using in your last example.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 5, 2017, 1:18pm UTC](https://discuss.elastic.co/t/multiline-filter-single-threaded/77783/5 "2017-04-05T13:18:59Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.