# Parsine multiline in logstash
**URL:** https://discuss.elastic.co/t/parsine-multiline-in-logstash/89919
**Category:** Logstash
**Created:** [June 19, 2017, 11:34am UTC](https://discuss.elastic.co/t/parsine-multiline-in-logstash/89919 "2017-06-19T11:34:00Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@baha1](https://discuss.elastic.co/u/baha1)
#### Post date: [June 19, 2017, 11:34am UTC](https://discuss.elastic.co/t/parsine-multiline-in-logstash/89919/1 "2017-06-19T11:34:00Z")
Hi every body,
i have a log file like below:
```
Line1 : 17:13:41,971 ERROR [org.apache.catalina.core.ContainerBase.[jboss.web].[default-host]] (http-/0.0.0.0:10805-7) JBWEB000313: Exception processing error page /error/error.
Line2 :17:13:42,035 ERROR [org.apache.catalina.core.ContainerBase.[jboss.web].[default-host].[/clientV3].
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
more......
Caused by: This is the line I want to capture
```
My pipeline is:
```
input {
file {
path => "c:/logstash.log"
start_position => "beginning"
sincedb_path => "/dev/null"
codec => multiline {
pattern => "^%{TIMESTAMP_ISO8601} "
negate => true
what => previous
}
}
}
filter {
grok{
match => { "message" => "%{TIME:date} %{LOGLEVEL:level} %{GREEDYDATA:message}" }
add_tag => ["groked"]
remove_tag => ["_grokparsefailure"]
}
}
output {
if "ERROR" in [level]
{
elasticsearch {
hosts=>"localhost:9200"
index => "errors"
document_type => "error"
}}
stdout { codec => rubydebug }
}
```
Note:1-when i don't use multiline plugin,i get some result relatively correct.but in the line 2 its shows just the first line it doesn't continue to show after at....
2-when i use multiline plugin it doesn't shwo `17:13:42,035 ERROR [org.apache.catalina.core.ContainerBase.[jboss.web].[default-host]`..it starts for example from the seconde at..
```
any help would be greatly appreciated
```
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 22, 2017, 5:20am UTC](https://discuss.elastic.co/t/parsine-multiline-in-logstash/89919/2 "2017-06-22T05:20:29Z")
Your messages don't begin with an ISO8601 timestamp so TIMESTAMP\_ISO8601 is the wrong pattern to use. Perhaps TIME will work better?
---
### Author:  [@baha1](https://discuss.elastic.co/u/baha1)
#### Post date: [June 22, 2017, 9:43am UTC](https://discuss.elastic.co/t/parsine-multiline-in-logstash/89919/3 "2017-06-22T09:43:24Z")
Thank you so much.you are totaly [right.it](http://right.it) works now fine.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 20, 2017, 9:43am UTC](https://discuss.elastic.co/t/parsine-multiline-in-logstash/89919/4 "2017-07-20T09:43:47Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.