# Need a clarification regarding filebeat & multiline codec
**URL:** https://discuss.elastic.co/t/need-a-clarification-regarding-filebeat-multiline-codec/39065
**Category:** Beats
**Tags:** filebeat
**Created:** [January 13, 2016, 7:03am UTC](https://discuss.elastic.co/t/need-a-clarification-regarding-filebeat-multiline-codec/39065 "2016-01-13T07:03:42Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@vinod8427](https://discuss.elastic.co/u/vinod8427)
#### Post date: [January 13, 2016, 7:03am UTC](https://discuss.elastic.co/t/need-a-clarification-regarding-filebeat-multiline-codec/39065/1 "2016-01-13T07:03:42Z")
Currently I am running a filebeat instance on one client. The output of filebeat is directed to logstash and a FQDN is entered for logstash hosts. This FQDN can resolve to 3 IP's where 3 instances of logstash are running. So in this scenario there is a chance that every event can get sent to every other logstash instance running on 3 different servers randomly depending on FQDN resolution. This is fine as the 3 servers are part of a cluster but I am assuming the problem might arise when we use multi line codec on the input section of logstash config. See below the logstash config:
```
input {
beats {
port => "5033"
codec => multiline {
negate => "true"
pattern => "(\.MAJOR)"
what => "previous"
}
}
}
```
Since I have used multiline codec on the input section, it would work fine as long all events are sent to just one logstash instance. But what would happen in my case where FQDN might resolve randomly to any logstash instance and every other event is sent to every other logstash instances running on 3 different servers? I am assuming that the events in multiline codec might match incorrectly or might even not match at all. Please clarify my doubt. In the meantime I still haven't tried this but I think I might run into this issue when I bring my setup up and running.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [January 13, 2016, 7:29am UTC](https://discuss.elastic.co/t/need-a-clarification-regarding-filebeat-multiline-codec/39065/2 "2016-01-13T07:29:51Z")
Indeed, the configuration above will only work if Filebeat connects to a single Logstash server. Multiline support is on the way in for Filebeat and that's what you want to go for.
---
### Author:  [@vinod8427](https://discuss.elastic.co/u/vinod8427)
#### Post date: [January 13, 2016, 7:36am UTC](https://discuss.elastic.co/t/need-a-clarification-regarding-filebeat-multiline-codec/39065/3 "2016-01-13T07:36:59Z")
Thanks Magnus. I just happened to come across this [link](https://github.com/elastic/beats/issues/461) which is a ticket in filebeat to bring in the support for multiline codec. That's great news BTW. Well the ticket says the support is ready and ticket is closed. Do you think I can use the latest nightlies to try this feature out?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [January 13, 2016, 8:12am UTC](https://discuss.elastic.co/t/need-a-clarification-regarding-filebeat-multiline-codec/39065/4 "2016-01-13T08:12:07Z")
Yes, in that case the feature should be ready in the nightlies (or if you build from master yourself).
---
### Author:  [@ruflin](https://discuss.elastic.co/u/ruflin)
#### Post date: [January 13, 2016, 9:01am UTC](https://discuss.elastic.co/t/need-a-clarification-regarding-filebeat-multiline-codec/39065/5 "2016-01-13T09:01:55Z")
The feature will be shipped with filebeat 1.1. If you prefer something as close to 1.1 as possible and more stable, build it from the 1.1 branch, or if you are fine with the nightlies, pick it from here: [https://beats-nightlies.s3.amazonaws.com/index.html?prefix=filebeat/](https://beats-nightlies.s3.amazonaws.com/index.html?prefix=filebeat/)
---
### Author:  [@vinod8427](https://discuss.elastic.co/u/vinod8427)
#### Post date: [January 13, 2016, 9:48am UTC](https://discuss.elastic.co/t/need-a-clarification-regarding-filebeat-multiline-codec/39065/6 "2016-01-13T09:48:48Z")
Thanks Nicolas 🙂
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2017, 9:56pm UTC](https://discuss.elastic.co/t/need-a-clarification-regarding-filebeat-multiline-codec/39065/7 "2017-07-05T21:56:47Z")