# Multiline - match whole file

**URL:** https://discuss.elastic.co/t/multiline-match-whole-file/73630
**Category:** Logstash
**Created:** [February 2, 2017, 5:42am UTC](https://discuss.elastic.co/t/multiline-match-whole-file/73630 "2017-02-02T05:42:23Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![kazan](https://avatars.discourse-cdn.com/v4/letter/k/839c29/32.png) [@kazan](https://discuss.elastic.co/u/kazan)
#### Post date: [February 2, 2017, 5:42am UTC](https://discuss.elastic.co/t/multiline-match-whole-file/73630/1 "2017-02-02T05:42:23Z")

</div>

Hi there,

I'm having a problem with matching the whole file. So basically I want to have content of the whole in my "message" field. So I'm trying to use multiline in filter section. What pattern should I set? I tried `pattern => "/.*./gm"` but it doesn't work in my case. I also tried patter that doesn't exist in a file, still some input files split in multiple messages.

> <https://stackoverflow.com/questions/31875384/match-whole-file>

I'm trying to input regular nmap output file, `-oN` - option in nmap  
Below is logstash conf file

```
input {
  lumberjack {
    port => 5001
    type => "nmap-full"
    ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt"
    ssl_key => "/etc/pki/tls/private/logstash-forwarder.key"
  }
}

filter {
    if [type] == "nmap-full" {
     multiline {
      pattern => "/.*./gm"
      negate => true
      what => "previous"
      stream_identity => "%{host}.%{file}.%{type}"
      }
   }
}

output {
# elasticsearch { hosts => "localhost"}
  stdout {
    codec => rubydebug
  }
}
```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 2, 2017, 5:42am UTC](https://discuss.elastic.co/t/multiline-match-whole-file/73630/2 "2017-03-02T05:42:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.