# Multiline log (array) with logstash

**URL:** <https://discuss.elastic.co/t/multiline-log-array-with-logstash/36477>\
**Category:** Logstash\
**Created:** [December 6, 2015, 5:43pm UTC](https://discuss.elastic.co/t/multiline-log-array-with-logstash/36477 "2015-12-06T17:43:30Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![tikejhya](https://avatars.discourse-cdn.com/v4/letter/t/77aa72/32.png) [@tikejhya](https://discuss.elastic.co/u/tikejhya)\
**Post date:** [December 6, 2015, 5:43pm UTC](https://discuss.elastic.co/t/multiline-log-array-with-logstash/36477/1 "2015-12-06T17:43:30Z")

</div>

I want to parse logfile with logstash which contains both single line and multiple line. [e.g first 2 lines with 1 line log entry whereas 3rd one has multiple line entry]

> ERROR - 2015-12-05 20:48:53 --\> Could not find page  
> ERROR - 2015-12-05 20:48:53 --\> Could not find VAR  
> ERROR - 2015-12-05 20:48:59 --\> Array  
> (  
> [id] =\> 12344  
> [studentid] =\> 33  
> [fname] =\>  
> [lname] =\>  
> [address] =\> tokyo  
> )

This log entry is forwarded from client (logstatsh-forwarder) which sets type as "multilineclient"

> filter{  
> if [type] == "multilineclient" {  
> multiline {  
> pattern =\> "^ERROR"  
> what =\> "previous"  
> }  
> grok{  
> match =\> {"message" =\> "%{LOGLEVEL:loglevel}\s+%{TIMESTAMP\_ISO8601:timestamp}\s+%{DATA:message}({({[^}]+},?\s\*)_})?\s_$(?(?m:.\*))?"}  
> }

> ```
> mutate {
> remove => ["@loglevel"]
> }
> 
> ```
> 
> }  
> }

I did try both Grok Debugger and grok constructer (but couldn't quite solve issue with LOGLEVEL being start of logfile ),

My multiline logs (array) are parsed as separate message.

message: [id] =\>  
message: [studentid] =\>  
message: [fname] =\>  
I was expecting this to come as single "message:"

Any suggestion?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:19am UTC](https://discuss.elastic.co/t/multiline-log-array-with-logstash/36477/2 "2017-07-06T05:19:51Z")

</div>