# Multilne codec merging UDP log entries **URL:** \ **Category:** Logstash\ **Created:** [January 12, 2017, 3:18pm UTC](https://discuss.elastic.co/t/multilne-codec-merging-udp-log-entries/71395 "2017-01-12T15:18:50Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Nezzerscape](https://avatars.discourse-cdn.com/v4/letter/n/d78d45/32.png) [@Nezzerscape](https://discuss.elastic.co/u/Nezzerscape)\ **Post date:** [January 12, 2017, 3:18pm UTC](https://discuss.elastic.co/t/multilne-codec-merging-udp-log-entries/71395/1 "2017-01-12T15:18:51Z")
I am using the multiline codec in Logstash 5.0. For the most part it works, merging entries that consist of several lines. So far all true multiline entries are merged correctly. The issue is that some random entries are being merged as well. ``` udp { host => "172.17.220.148" port => 514 type => "netapp" codec => multiline { pattern => "^\s" what => "previous" } ``` Here is an example of merging that should not occur: Source \<191\>Jan 12 08:03:55 [host:api\_mpool\_06:debug]: sumnerTunnel:command is exec /sbin/asup\_opt -priv 'admin' -get 'autosupport.enable':command exit status: 0 \<191\>Jan 12 08:03:55 [host:api\_mpool\_06:debug]: sumnerTunnel:command is exec /sbin/asup\_opt -priv 'admin' -get 'autosupport.enable':mhost\_exec\_internal return status: 0 after grok: sumnerTunnel:command is exec /sbin/asup\_opt -priv 'admin' -get 'autosupport.enable':command exit status: 0 \<191\>Jan 12 08:03:55 [host:api\_mpool\_06:debug]: sumnerTunnel:command is exec /sbin/asup\_opt -priv 'admin' -get 'autosupport.enable':mhost\_exec\_internal return status: 0 grok works fine. I do see some grok errors but the original message is blank. I looked at both the previews and next entry and they look good. To add some scope a 6 day sampling consists of: 405257 entries total 36 entries with grok errors (the entries do not contain any information so safe to drop) 245 entries that contain 2 entries in one All true multi-line entries work (that I looked at) I remembering reading something about a buffer causing this but could not find it again. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [January 12, 2017, 5:00pm UTC](https://discuss.elastic.co/t/multilne-codec-merging-udp-log-entries/71395/2 "2017-01-12T17:00:55Z")
UDP does not guarantee delivery or ordering so I would if possible recommend doing multiline processing before sending the data via UDP. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 9, 2017, 5:01pm UTC](https://discuss.elastic.co/t/multilne-codec-merging-udp-log-entries/71395/3 "2017-02-09T17:01:02Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.