# Need help using "Logstash multiline codec" to parse below oswatcher log lines

**URL:** <https://discuss.elastic.co/t/need-help-using-logstash-multiline-codec-to-parse-below-oswatcher-log-lines/244040>\
**Category:** Logstash\
**Created:** [August 6, 2020, 2:32pm UTC](https://discuss.elastic.co/t/need-help-using-logstash-multiline-codec-to-parse-below-oswatcher-log-lines/244040 "2020-08-06T14:32:13Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![saurabhc](https://avatars.discourse-cdn.com/v4/letter/s/c68b51/32.png) [@saurabhc](https://discuss.elastic.co/u/saurabhc)\
**Post date:** [August 6, 2020, 2:32pm UTC](https://discuss.elastic.co/t/need-help-using-logstash-multiline-codec-to-parse-below-oswatcher-log-lines/244040/1 "2020-08-06T14:32:13Z")

</div>

I have logs from oswatcher which looks like below.

```
zzz ***Thu Jul 23 14:00:31 UTC 2020
MemoryTotal: 100831888 kB
MemoryFree: 1212388 kB
MemoryAvailable: 49997588 kB
zzz ***Thu Jul 23 14:01:02 UTC 2020
MemoryTotal: 100831888 kB
MemoryFree: 1188012 kB
MemoryAvailable: 49975416 kB
zzz ***Thu Jul 23 14:01:33 UTC 2020
MemoryTotal: 100831888 kB
MemoryFree: 1139428 kB
MemoryAvailable: 49944268 kB
zzz ***Thu Jul 23 14:02:03 UTC 2020
MemoryTotal: 100831888 kB
MemoryFree: 1147540 kB
MemoryAvailable: 49949120 kB

```

In this example, I want to parse from "line starting with **zzz**" to the next occurrence of "line starting with **zzz**" as a _single line_ (using the multiline codec).  
How I can use the multiline codec for this.  
Only in case of the last occurrence of "line starting with **zzz**", the end of multiline would be _end of file_.

OR,  
Is there any other alternative to do this.

**Objective:** I want output csv with each row having timestamp,MemoryTotal,MemoryFree,MemoryAvailable values.

---

<div class="post-metadata">

**Author:** ![saurabhc](https://avatars.discourse-cdn.com/v4/letter/s/c68b51/32.png) [@saurabhc](https://discuss.elastic.co/u/saurabhc)\
**Post date:** [August 6, 2020, 2:34pm UTC](https://discuss.elastic.co/t/need-help-using-logstash-multiline-codec-to-parse-below-oswatcher-log-lines/244040/2 "2020-08-06T14:34:37Z")

</div>

Similarly, I need to parse outputs from TOP, VMSTAT, PS etc commands where the outputs starts with a "line starting with **zzz**".

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 6, 2020, 2:34pm UTC](https://discuss.elastic.co/t/need-help-using-logstash-multiline-codec-to-parse-below-oswatcher-log-lines/244040/3 "2020-08-06T14:34:45Z")

</div>

Try

```
codec => multiline {
    pattern => "^zzz"
    negate => "true"
    what => "previous"
    auto_flush_interval = 10
}
```

---

<div class="post-metadata">

**Author:** ![saurabhc](https://avatars.discourse-cdn.com/v4/letter/s/c68b51/32.png) [@saurabhc](https://discuss.elastic.co/u/saurabhc)\
**Post date:** [August 6, 2020, 4:18pm UTC](https://discuss.elastic.co/t/need-help-using-logstash-multiline-codec-to-parse-below-oswatcher-log-lines/244040/4 "2020-08-06T16:18:39Z")

</div>

Thank You! It worked.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 3, 2020, 4:18pm UTC](https://discuss.elastic.co/t/need-help-using-logstash-multiline-codec-to-parse-below-oswatcher-log-lines/244040/5 "2020-09-03T16:18:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.