# Multiple patterns in multiline codec **URL:** \ **Category:** Logstash\ **Created:** [January 28, 2016, 8:28am UTC](https://discuss.elastic.co/t/multiple-patterns-in-multiline-codec/40336 "2016-01-28T08:28:12Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![MatthiasLenhardt](https://avatars.discourse-cdn.com/v4/letter/m/a9adbd/32.png) [@MatthiasLenhardt](https://discuss.elastic.co/u/MatthiasLenhardt)\ **Post date:** [January 28, 2016, 8:28am UTC](https://discuss.elastic.co/t/multiple-patterns-in-multiline-codec/40336/1 "2016-01-28T08:28:13Z")
Hello All, I'm sending Syslog messages to our elasticsearch cluster via logstash and have currently configured one multiline codec in my logstash.conf input section to handle a default behaviour of syslog for many equal messages ("last message repeated n times"): file { path =\> "/var/adm/messages" sincedb\_path =\> "/export/logstash/sincedb" start\_position =\> "beginning" tags =\> ["syslog", "solaris"] codec =\> multiline { charset =\> "ISO-8859-1" pattern =\> "^%{TIMESTAMP\_ISO8601} {SYSLOGHOST} last message repeated " what =\> "previous" negate =\> false } } Now I found in my syslogs another multiline case: Jan 25 10:19:10 xxx nfs: [ID 941083 [kern.info](http://kern.info)] NOTICE: NFS4 FACT SHEET: Jan 25 10:19:10 xxx Action: NR\_STALE Jan 25 10:19:10 xxx NFS4 error: NFS4ERR\_STALE My question is not about the pattern itself to handle this multiline, but how to integrate a "second" pattern for this into the above file section of logstash.conf? Thanks in advance for a tiny hint! Best Regards Matthias ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:13am UTC](https://discuss.elastic.co/t/multiple-patterns-in-multiline-codec/40336/2 "2017-07-06T05:13:58Z")