# Multiline work strange

**URL:** <https://discuss.elastic.co/t/multiline-work-strange/118810>\
**Category:** Logstash\
**Created:** [February 7, 2018, 10:38am UTC](https://discuss.elastic.co/t/multiline-work-strange/118810 "2018-02-07T10:38:20Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![breezzz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/breezzz/32/18245_2.png) [@breezzz](https://discuss.elastic.co/u/breezzz)\
**Post date:** [February 7, 2018, 10:38am UTC](https://discuss.elastic.co/t/multiline-work-strange/118810/1 "2018-02-07T10:38:20Z")

</div>

Good day!

I created a theme about udp and multiline. After that I switched to tсp.  
After watching for a while I found strange things, they end if I disable multiline.  
config is:

```
input {
  tcp {
    port => 5200
    codec => multiline {
       pattern => "^((gwmd|mddump|trade)[a-zA-Z0-9-]+.example.net) (DEBUG|INFO|ERROR|WARNING) (.+)"
      negate => true
      what => "previous"
    }
  }
}

filter {
    dissect {
      mapping => { "message" => "%{host} %{levelname} %{name} %{asctime} %{+asctime} %{module} %{process} %{thread} %{message}"}
    }
    date {
      match => ["asctime", "YYYY-MM-dd HH:mm:ss,SSS"]
      timezone => "Etc/UTC"
    }
}

output {
  elasticsearch {
    hosts => ["localhost:9200"]
  }
}

```

strange things are:

word "process:" in "message" looks like

> process:  
> proc ess:  
> p rocess:  
> pro cess:  
> proce ss:  
> pr ocess:  
> proces s:

also host, but for host i apply additional regexp.  
But even with this additional regexp, i have strange message as this:

```
"message": "Response:[17236, 7422.9, 1, 2]\ngwmd-btc-usd.\nexample.net DEBUG mdengines_Bitfinex_BTC_USD 2018-02-06 22:40:56,001 bitfinex 5151 140172730033984 asks = [], bids = [[7422.9, 2]], updates = [[7422.9, 1, 2]]",
"tags": [
  "multiline"
],

```

new string symbol in the middle of host name cause multiline for valid string and it be invalid after this, and glue to the previous line

Is there some recommendations about solve this stranges?

logs send to logstash from hosts by syslog-ng with very simple configuration

```
destination d_remote_server {
   tcp("kibana.example.net" port(5200) template("$LOGHOST $MSG\n"));
};

```

---

<div class="post-metadata">

**Author:** ![breezzz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/breezzz/32/18245_2.png) [@breezzz](https://discuss.elastic.co/u/breezzz)\
**Post date:** [February 14, 2018, 4:51pm UTC](https://discuss.elastic.co/t/multiline-work-strange/118810/2 "2018-02-14T16:51:37Z")

</div>

this is solve problem, but requires a lot of resources

```
filter {
    dissect {
      mapping => { "message" => "%{host} %{levelname} %{name} %{asctime} %{+asctime} %{module} %{process} %{thread} %{message}"}
    }
  mutate {
    gsub => [
      "host", "\n", "",
      "levelname", "\n", "",
      "name", "\n", "",
      "asctime", "\n", "",
      "module", "\n", "",
      "process", "\n", "",
      "thread", "\n", "",
      "message", "\n", ""
    ]
  }
    date {
      match => ["asctime", "YYYY-MM-dd HH:mm:ss,SSS"] #2018-01-29 22:16:59,537
      timezone => "Etc/UTC"
    }
}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 14, 2018, 4:51pm UTC](https://discuss.elastic.co/t/multiline-work-strange/118810/3 "2018-03-14T16:51:39Z")

</div>

Closed on March 14, 2018, 4:51pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.