# Multiline Logstash

**URL:** <https://discuss.elastic.co/t/multiline-logstash/172915>\
**Category:** Logstash\
**Created:** [March 19, 2019, 8:31am UTC](https://discuss.elastic.co/t/multiline-logstash/172915 "2019-03-19T08:31:57Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sanriya\_Krimzn](https://avatars.discourse-cdn.com/v4/letter/s/54ee81/32.png) [@Sanriya\_Krimzn](https://discuss.elastic.co/u/Sanriya_Krimzn)\
**Post date:** [March 19, 2019, 8:31am UTC](https://discuss.elastic.co/t/multiline-logstash/172915/1 "2019-03-19T08:31:57Z")

</div>

Hi I am using multilint to extract data from  
**Sample Log**  
_[This_  
\*'create' =\> \*  
_array (_  
_'key1' =\> 'value1',_  
_'key2' =\> 'value2',_  
_'key6' =\> 'value3'_  
_),_  
_)_  
_[2014-03-02 17:34:20] - 127.0.0.1|DEBUG| flush\_multi\_line_

**Code Snippet**  
filter{  
multiline{  
pattern =\> "^[This.\*"  
what =\> "previous"  
negate=\> true  
}  
if "|DEBUG| flush\_multi\_line" in [message]{  
drop{} # We don't need the dummy line so drop it  
}  
}

The above code snippet doesn't work.  
What am I missing???

---

<div class="post-metadata">

**Author:** ![Sanriya\_Krimzn](https://avatars.discourse-cdn.com/v4/letter/s/54ee81/32.png) [@Sanriya\_Krimzn](https://discuss.elastic.co/u/Sanriya_Krimzn)\
**Post date:** [March 20, 2019, 6:30am UTC](https://discuss.elastic.co/t/multiline-logstash/172915/2 "2019-03-20T06:30:53Z")

</div>

Any Thoughts on this???

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [March 20, 2019, 6:47am UTC](https://discuss.elastic.co/t/multiline-logstash/172915/3 "2019-03-20T06:47:16Z")

</div>

I wonder if your pattern should just go as far as the first square bracket as it otherwise will not match the line that you are dropping. As it is now I would expect this example to form a single line and be dropped. If you output the lines you want to drop to a file instead it might be easier to see what is dropped and figure out why.

---

<div class="post-metadata">

**Author:** ![Sanriya\_Krimzn](https://avatars.discourse-cdn.com/v4/letter/s/54ee81/32.png) [@Sanriya\_Krimzn](https://discuss.elastic.co/u/Sanriya_Krimzn)\
**Post date:** [March 20, 2019, 7:26am UTC](https://discuss.elastic.co/t/multiline-logstash/172915/4 "2019-03-20T07:26:01Z")

</div>

**Sample Log:**  
11 This 96.112.248.81  
'create' =\>  
array (  
'key1' =\> 'value1',  
'key2' =\> 'value2',  
'key6' =\> 'value3'  
),  
)  
[2014-03-02 17:34:20] - 127.0.0.1|DEBUG| flush\_multi\_line  
**Code Snippet 1**  
`
filter {
multiline{
pattern => "[0-9]*\s+%{DATA}\s+%{IP}"
what => "previous"
negate=> true
}
if "|DEBUG| flush_multi_line" in [message]{
drop{} # We don't need the dummy line so drop it
}
kv {
field_split => "\n"
#value_split => ":"
source => "message"
}
}
`

**Code Snippet 2**  
`
filter {
multiline{
pattern => "^11 This %{IP}"
what => "previous"
negate=> true
}
if "|DEBUG| flush_multi_line" in [message]{
drop{} # We don't need the dummy line so drop it
}
kv {
field_split => "\n"
source => "message"
}
}
`

Code Snippet 1 Works and Code Snippet 2 doesn't work.  
Only difference is pattern in multiline.  
In **Snippet 1 pattern is "[0-9]\*\s+%{DATA}\s+%{IP}"**  
In **Snippet 2 pattern is "^11 This %{IP}"**

Can you figure out mistake am doing in Snippet 2???

---

<div class="post-metadata">

**Author:** ![Sanriya\_Krimzn](https://avatars.discourse-cdn.com/v4/letter/s/54ee81/32.png) [@Sanriya\_Krimzn](https://discuss.elastic.co/u/Sanriya_Krimzn)\
**Post date:** [March 20, 2019, 12:53pm UTC](https://discuss.elastic.co/t/multiline-logstash/172915/5 "2019-03-20T12:53:48Z")

</div>

Any Thoughts on this??

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 17, 2019, 12:53pm UTC](https://discuss.elastic.co/t/multiline-logstash/172915/6 "2019-04-17T12:53:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.