# Multiline plugin not merging lines and throwing \_grokparsefailure **URL:** \ **Category:** Logstash\ **Created:** [December 21, 2017, 10:29am UTC](https://discuss.elastic.co/t/multiline-plugin-not-merging-lines-and-throwing-grokparsefailure/112799 "2017-12-21T10:29:02Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![vinit](https://avatars.discourse-cdn.com/v4/letter/v/ecc23a/32.png) [@vinit](https://discuss.elastic.co/u/vinit)\ **Post date:** [December 21, 2017, 10:29am UTC](https://discuss.elastic.co/t/multiline-plugin-not-merging-lines-and-throwing-grokparsefailure/112799/1 "2017-12-21T10:29:02Z")
Hi, In logstash 1.x, used multiline plugin to merge all lines those are not starting with Timestamp and found issue that in some cases it didn't worked. Filter: multiline { patterns\_dir =\> "/u01/data/conf/patterns" pattern =\> "^%{SERVERTIMESTAMP} " negate =\> true what =\> "previous" } mutate { gsub =\> ["message", "\n", " "] gsub =\> ["message", "\t", " "] } grok { break\_on\_match =\> false patterns\_dir =\> "/u01/data/conf/patterns" match =\> ["message", "%{IDCS\_LOG\_FM}"] } Tested in logstash 5.x, but not able to reproduce this issue. Need help? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [December 21, 2017, 7:39pm UTC](https://discuss.elastic.co/t/multiline-plugin-not-merging-lines-and-throwing-grokparsefailure/112799/2 "2017-12-21T19:39:53Z")
The multiline filter has been deprecated, so use the multiline functionality of Filebeat or the multiline codec plugin instead. ---
**Author:** ![vinit](https://avatars.discourse-cdn.com/v4/letter/v/ecc23a/32.png) [@vinit](https://discuss.elastic.co/u/vinit)\ **Post date:** [December 22, 2017, 3:45am UTC](https://discuss.elastic.co/t/multiline-plugin-not-merging-lines-and-throwing-grokparsefailure/112799/3 "2017-12-22T03:45:13Z")
Yes u r right. Using codec multiline in input it's working fine with logstash 5.x But this issue is in logstash 1.x where multiline plugin was present. ---
**Author:** ![vinit](https://avatars.discourse-cdn.com/v4/letter/v/ecc23a/32.png) [@vinit](https://discuss.elastic.co/u/vinit)\ **Post date:** [December 22, 2017, 7:12am UTC](https://discuss.elastic.co/t/multiline-plugin-not-merging-lines-and-throwing-grokparsefailure/112799/4 "2017-12-22T07:12:37Z")
Below are the examples: **Good Case (All lines merged)** Dec 22, 2017 6:08:10 AM oracle.idaas.common.event.impl.EventManagerImpl logEvent INFO: Event: system.info.runtime, Generated: Fri Dec 22 06:08:10 GMT 2017, Host: idcssydenydyntopob1746try1-ssov1-1.idcs.oraclecloud.internal (10.196.132.46), with targets metrics: false, audit: false, notification: false, analyze: false, subscribe: false oracle.idaas.common.cache.RemoteAPIProxySCIMService RemoteAPIProxySCIMService/getCompositeKeyBasedSearch: entered with resourceType:Key tenant:idcs-cloudinfra-aucom-east-1 filter:AND{left=AND{left=FilterImpl{propertyName=keyAlias, op=EQUALS, propertyValue=GenericCGForLBaaS\_APPID\_next}, isComplex=false, right=FilterImpl{propertyName=keyStoreId, op=EQUALS, propertyValue=2019b30136a543a39d2b61860a170593}}, isComplex=false, right=FilterImpl{propertyName=type, op=EQUALS, propertyValue=Key}} ECID: eOvGZ0nwZ00000000, Tenant: idcs-f5b6c873e93b4d4c99083f23ac2eb40a, RID: 0:1:6:2, Service Name: SSO Actor ID: null, Actor Name: null, Actor Display Name: null, Actor Type: null, Client IP: 10.245.54.162, Client ID: null, Client Name: null, Session Id: null Event Data: {"idcs\_ext\_url":"https://%tenant%.identity.c9qa132.oc9qadev.com"} **Bad Case (Multiline didn't merged)** Dec 22, 2017 6:24:26 AM oracle.idaas.common.event.impl.EventManagerImpl logEvent INFO: Event: system.info.runtime, Generated: Fri Dec 22 06:12:30 GMT 2017, Host: idcssydenydyntopob1746try1-ssov1-1.idcs.oraclecloud.internal (10.196.132.46), with targets metrics: false, audit: false, notification: false, analyze: false, subscribe: false oracle.idaas.common.cache.RemoteAPIProxySCIMService RemoteAPIProxySCIMService/get: entered with resourceType:GlobalConfig tenant:idcs-cloudinfra-aucom-east-1 options:SearchOptionsImpl{sortOrder=ASCENDING, count=NumberValueImpl{number=50}, startIndex=NumberValueImpl{number=1}} id:GlobalConfig ECID: qY3sW1L0Z00000000, Tenant: idcs-eb5b11d44630441e9d76b336d51f8615, RID: 0:1, Service Name: SSO Actor ID: null, Actor Name: null, Actor Display Name: null, Actor Type: null, Client IP: 10.244.186.113, Client ID: null, Client Name: null, Session Id: null Event Data: {"idcs\_ext\_url":"https://%tenant%.identity.c9qa132.oc9qadev.com"} FINE: Service [sso-v1::10.196.132.46] Service Status :: RUNNING ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [December 22, 2017, 7:57am UTC](https://discuss.elastic.co/t/multiline-plugin-not-merging-lines-and-throwing-grokparsefailure/112799/5 "2017-12-22T07:57:24Z")
I would recommend that you upgrade from Logstash 1.x. There were good reasons why the multiline filter plugin was deprecated. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 19, 2018, 7:57am UTC](https://discuss.elastic.co/t/multiline-plugin-not-merging-lines-and-throwing-grokparsefailure/112799/6 "2018-01-19T07:57:31Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.