# Multiple Mulitiline Patterns?

**URL:** <https://discuss.elastic.co/t/multiple-mulitiline-patterns/86995>\
**Category:** Logstash\
**Created:** [May 24, 2017, 2:59pm UTC](https://discuss.elastic.co/t/multiple-mulitiline-patterns/86995 "2017-05-24T14:59:36Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jaxon\_Kochel](https://avatars.discourse-cdn.com/v4/letter/j/da6949/32.png) [@Jaxon\_Kochel](https://discuss.elastic.co/u/Jaxon_Kochel)\
**Post date:** [May 24, 2017, 2:59pm UTC](https://discuss.elastic.co/t/multiple-mulitiline-patterns/86995/1 "2017-05-24T14:59:36Z")

</div>

I'm wondering if there is any way to have multiple multiline patterns. I see this post [https://discuss.elastic.co/t/solution-for-multiple-patterns-for-multiline-configuration/43807](https://discuss.elastic.co/t/solution-for-multiple-patterns-for-multiline-configuration/43807)

which looks like he got something to work. I'm trying to do exactly as he was and and looking to do:

```
codec => multiline {
       pattern => "(%{MONTHNUM}/%{MONTHDAY}/%{YEAR}) | (%{DATESTAMP})"
      negate => true
      what => "previous"
      max_lines => 1000
      auto_flush_interval => 3
    }

```

However, when I do this only the first pattern works, so only %{MONTHNUM}/%{MONTHDAY}/%{YEAR} works and DATESTAMP does not and any datestamp lines get thrown into one giant multiline. If I switch the order and have DATESTAMP | %{MONTHNUM}/%{MONTHDAY}/%{YEAR} then only datestamp will work and any MONTHNUM}/%{MONTHDAY}/%{YEAR} will get thrown into one giant multiline.

Any help is greatly appreciated.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 28, 2017, 6:45pm UTC](https://discuss.elastic.co/t/multiple-mulitiline-patterns/86995/2 "2017-05-28T18:45:15Z")

</div>

Watch out for the spaces surrounding "|". Do you really have a space before the DATESTAMP? Suggestion:

```
^%{MONTHNUM}/%{MONTHDAY}/%{YEAR})|%{DATESTAMP}
```

---

<div class="post-metadata">

**Author:** ![Jaxon\_Kochel](https://avatars.discourse-cdn.com/v4/letter/j/da6949/32.png) [@Jaxon\_Kochel](https://discuss.elastic.co/u/Jaxon_Kochel)\
**Post date:** [May 31, 2017, 1:40pm UTC](https://discuss.elastic.co/t/multiple-mulitiline-patterns/86995/3 "2017-05-31T13:40:09Z")

</div>

Magnus I did not try this, but it seems like it should work. I feel silly having put the spaces around the "|" before you responded I was able to solve this by using a more general pattern of "^%{NOTSPACE} ?-? ?%{TIME}" to solve all my needs.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 28, 2017, 1:40pm UTC](https://discuss.elastic.co/t/multiple-mulitiline-patterns/86995/4 "2017-06-28T13:40:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.