# Multiline support in logstash

**URL:** https://discuss.elastic.co/t/multiline-support-in-logstash/129995
**Category:** Logstash
**Created:** [April 30, 2018, 8:36am UTC](https://discuss.elastic.co/t/multiline-support-in-logstash/129995 "2018-04-30T08:36:43Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![sonusr](https://avatars.discourse-cdn.com/v4/letter/s/58956e/32.png) [@sonusr](https://discuss.elastic.co/u/sonusr)
#### Post date: [April 30, 2018, 8:36am UTC](https://discuss.elastic.co/t/multiline-support-in-logstash/129995/1 "2018-04-30T08:36:44Z")

</div>

HI,  
Is it possible to send log4j multi-line logs as single event from logstash without filebeat? I tried the following multiline codec in logstash conf file and no luck

input {  
file {  
path =\> "/var/log/mylog.log"  
codec =\> multiline {  
pattern =\> "^%{TIMESTAMP\_ISO8601} "  
negate =\> true  
what =\> previous  
}  
}  
}  
and my logs look like below

## 2018-04-30 13:56:36.568|I|LAPTOP-S488JKMQ|PID|28D4B93014229C40492D55949BF6F77C|a1be60ad-e7ba-4831-bbdd-6fdfb3c6a502|9be580f4|org.apache.cxf.interceptor.AbstractLoggingInterceptor:253|Outbound Message

## ID: 1 Response-Code: 500 Content-Type: application/json Headers: {Content-Type=[application/json], Date=[Mon, 30 Apr 2018 08:26:36 GMT]} Payload: The request failed due to an internal error.

## 2018-04-30 13:56:41.452|I|LAPTOP-S488JKMQ|PID|28D4B93014229C40492D55949BF6F77C|366eac6c-60cd-4948-b827-469451600c19|9be580f5|org.apache.cxf.interceptor.AbstractLoggingInterceptor:253|Inbound Message

Thanks in advance,  
Sonu

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [April 30, 2018, 6:29pm UTC](https://discuss.elastic.co/t/multiline-support-in-logstash/129995/2 "2018-04-30T18:29:50Z")

</div>

It doesn't look like there should be a space after the timestamp.

---

<div class="post-metadata">

### Author: ![sonusr](https://avatars.discourse-cdn.com/v4/letter/s/58956e/32.png) [@sonusr](https://discuss.elastic.co/u/sonusr)
#### Post date: [May 2, 2018, 10:30am UTC](https://discuss.elastic.co/t/multiline-support-in-logstash/129995/3 "2018-05-02T10:30:08Z")

</div>

Thanks Magnus for the reply.

I tried without space also. But no luck.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 30, 2018, 10:30am UTC](https://discuss.elastic.co/t/multiline-support-in-logstash/129995/4 "2018-05-30T10:30:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.