# Multiple configuration or multiple codec

**URL:** https://discuss.elastic.co/t/multiple-configuration-or-multiple-codec/329752
**Category:** Logstash
**Created:** [April 11, 2023, 1:58pm UTC](https://discuss.elastic.co/t/multiple-configuration-or-multiple-codec/329752 "2023-04-11T13:58:54Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![JackieLaFrite](https://avatars.discourse-cdn.com/v4/letter/j/9fc29f/32.png) [@JackieLaFrite](https://discuss.elastic.co/u/JackieLaFrite)
#### Post date: [April 11, 2023, 1:58pm UTC](https://discuss.elastic.co/t/multiple-configuration-or-multiple-codec/329752/1 "2023-04-11T13:58:55Z")

</div>

Here is my logstash.conf file

```auto
input {
  file {
    path => "/var/log/appslogs/**/*.log"
    start_position => "beginning"
    sincedb_path => "/dev/null"
    codec => plain {
      charset => "UTF-8"
    }
    type => "app"
  }
  file {
    path => "/var/log/serverlogs/*.log"
    start_position => "beginning"
    sincedb_path => "/dev/null"
    codec => multiline {
		pattern => "(?<timestamp>\d{2}-\w{3}-\d{4} \d{2}:\d{2}:\d{2}\.\d{3}) \[(?<thread>[^\]]+)\] (?<loglevel>(INFO|ERROR|DEBUG|TRACE|WARN)) \[(?<classname>[^\]]+)\] (?<message>.+(?:(?<=\n)(?!^\d{2}-\w{3}-\d{4} \d{2}:\d{2}:\d{2}\.\d{3} \[)))"
		negate => true
		what => "previous"
    }
    type => "server"
  }
}

filter{
	if [type] == "app" {
		grok{
			match => {"message" => [
				"%{TIMESTAMP_ISO8601:time} %{LOGLEVEL:log_level} %{GREEDYDATA:message_of_log}",
				"%{TIMESTAMP_ISO8601:time} \[%{LOGLEVEL:log_level}\] %{GREEDYDATA:message_of_log}\(%{GREEDYDATA}\)",
				"%{TIMESTAMP_ISO8601:time} \[%{LOGLEVEL:log_level}\] %{GREEDYDATA:message_of_log}",
				"%{TIMESTAMP_ISO8601:time} \[%{LOGLEVEL:log_level}\] %{GREEDYDATA:message_of_log}"
			]}
			add_field => {
			  "time_of_log" => "%{time}"
			}
		}
	}
	if [type] == "server" {
		grok{
			match => {"message" => [
				"%{MONTHDAY:day}-%{MONTH:month}-%{YEAR:year} %{TIME:time} %{LOGLEVEL:log_level} %{GREEDYDATA:message_of_log}",
				"\[%{MONTHDAY:day}-%{MONTH:month}-%{YEAR:year} %{TIME:time} %{LOGLEVEL:log_level} %{GREEDYDATA:message_of_log}\]"
			]}
			add_field => {
			    "time_of_log" => "%{day}-%{month}-%{year} %{time}"
			}
		}
	}
}

output {
  elasticsearch {
    hosts => ["elasticsearch:9200"]
    user => "elastic"
    password => "changeme"
    ecs_compatibility => disabled

  }
}

```

The problem is that I have multiple type of logs in the path /var/log/serverlogs/\*.log

I would like to have multiple multiline pattern, one for each type of logs but how can I do that ?

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 11, 2023, 3:40pm UTC](https://discuss.elastic.co/t/multiple-configuration-or-multiple-codec/329752/2 "2023-04-11T15:40:11Z")

</div>

> [@JackieLaFrite](#):
>
> I would like to have multiple multiline pattern, one for each type of logs but how can I do that ?

If you need more than one multiline codec then you are going to have to have more than one input. If you can distinguish which type of log each line belongs to then you could use a single file input without a multiline codec and then route lines to tcp output/input pairs that have a multiline codec.

---

<div class="post-metadata">

### Author: ![JackieLaFrite](https://avatars.discourse-cdn.com/v4/letter/j/9fc29f/32.png) [@JackieLaFrite](https://discuss.elastic.co/u/JackieLaFrite)
#### Post date: [April 12, 2023, 9:44am UTC](https://discuss.elastic.co/t/multiple-configuration-or-multiple-codec/329752/3 "2023-04-12T09:44:11Z")

</div>

Okay thanks

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 10, 2023, 9:45am UTC](https://discuss.elastic.co/t/multiple-configuration-or-multiple-codec/329752/4 "2023-05-10T09:45:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.