# Multiline not picking up events immediately

**URL:** https://discuss.elastic.co/t/multiline-not-picking-up-events-immediately/46823
**Category:** Logstash
**Created:** [April 8, 2016, 3:37pm UTC](https://discuss.elastic.co/t/multiline-not-picking-up-events-immediately/46823 "2016-04-08T15:37:18Z")
**Posts on this page:** 1
**Showing post:** 9

<div class="post-metadata">

### Author: ![Sameer\_Panicker](https://avatars.discourse-cdn.com/v4/letter/s/d9b06d/32.png) [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)
#### Post date: [April 11, 2016, 2:50pm UTC](https://discuss.elastic.co/t/multiline-not-picking-up-events-immediately/46823/9 "2016-04-11T14:50:36Z")

</div>

Conf -

input  
{  
file  
{  
path =\> "C:/MyLogs/\*"  
#start\_position =\> "beginning"  
}  
}

filter  
{  
grok  
{  
match =\>  
{  
"message" =\>  
[  
"ProviderId : %{UUID:SessionID}",  
"EventId : %{NUMBER:EventId}",  
"Payload : [sessionID : %{UUID:SessionID}] [type : %{WORD:ExceptionType}] [data : %{DATA:Data}] [innerException : %{DATA:InnerException}] [message : %{DATA:ExceptionMessage}] [source : %{DATA:ExceptionSource}] [stackTrace : (?(.|\r|\n)\*)]",  
"EventName : %{WORD:EventName}",  
"ProcessId : %{NUMBER:ProcessId}",  
"ThreadId : %{NUMBER:ThreadId}"  
]  
}  
}

```
mutate
{
	add_field => { "Type" => "ApiExceptionEventSource" }
	
	rename => { "path" => "Path" }
	rename => { "host" => "Host" }
}

```

}

output  
{  
stdout  
{  
codec =\> rubydebug  
}  
}

Log Pattern -

ProviderId : 46875d78-3924-5303-f49e-65b8bc0dc289  
EventId : 11  
Payload : [sessionID : 19c6fd3f-79d5-406a-9d93-f1ada6bc6fde] [type : InvalidMethodArgumentException] [data :] [innerException : ExceptionMessage] [message : The CallID field is required.] [source : MySol.Services.Common] [stackTrace : at MySol.Services.Common.Entities.Database.BaseEFService`1.<SaveAsync>d__0.MoveNext() in e:\Builds\15\IR\Main.QA\src\WebServiceSln\MySol.Services.Common\Entities\Database\BaseEFService.cs:line 101 --- End of stack trace from previous location where exception was thrown --- at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at MySol.Services.Common.Entities.Database.BaseEFCreateService`3.d\_\_3.MoveNext() in e:\Builds\15\IR\[Main.QA](http://Main.QA)\src\WebServiceSln\MySol.Services.Common\Entities\Database\BaseEFCreateService.cs:line 47  
--- End of stack trace from previous location where exception was thrown ---  
at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)  
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)  
at MySol.API.Common.MessageHandlers.CreateIRRRequestHeadersMessageHandler.d\_\_0.MoveNext() in e:\Builds\15\IR\[Main.QA](http://Main.QA)\src\WebServiceSln\MySol.API.Common\MessageHandlers\CreateIRRRequestHeadersMessageHandler.cs:line 58] [targetSite : Void MoveNext()]  
EventName : ResponseInfo  
ProcessId : 21096  
ThreadId : 12336

---

_[View the full topic](https://discuss.elastic.co/t/multiline-not-picking-up-events-immediately/46823)._