(PGStream.java:62)
> at org.postgresql.core.v3.ConnectionFactoryImpl.openConnectionImpl(ConnectionFactoryImpl.java:144)
> ... 13 more
>
> ```
I have seen on others topics that multilines plugin and patterns are usefull :
Pattern file :
> **Summary**
>
> `JAVA_TRACE (^.+Exception: .+)|(^\s+at .+)|(^\s+... \d+ more)|(^\s*Caused by:.+)`
Logstash config file :
> **Summary**
>
> ```
> input {
> tcp{
> port => 12201
> }
> udp{
> port => 12201
> }
>
> ```
>
> stdin{
> codec =\> multiline {
> pattern =\> "^%{DATE\_EU}"
> negate =\> "true"
> what =\> "previous"
> }
> }
>
> ```
> }
>
> filter{
> if [type]== "tomcat" {
> grok{
> patterns_dir => ["/conf/patterns"]
> match => {message => ["(^%{DATE_EU} %{TIME} %{LOGLEVEL} %{GREEDYDATA}) | (^%{JAVA_TRACE}) "]}
> tag_on_failure => ["failed"]
> }
>
> }
>
> }
>
> output{
> elasticsearch{
> hosts => ["elasticsearch:9200"]
> index => "test"
> }
> }
>
> ```
I created a grok pattern with a multiline codec, my logs seem to be parsed by the grok, but the multiIine is not working. I suppose that I missed something but i don't know what ... does anyone have an idea ?
Thx for your help.
---
### Author:  [@agentn](https://discuss.elastic.co/u/agentn)
#### Post date: [May 9, 2019, 9:57am UTC](https://discuss.elastic.co/t/parsing-multiline-tomcat-logs/178874/2 "2019-05-09T09:57:16Z")
Nobody ? ☹
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 9, 2019, 1:38pm UTC](https://discuss.elastic.co/t/parsing-multiline-tomcat-logs/178874/3 "2019-05-09T13:38:16Z")
I would expect that multiline codec to result in
```
"message" => "25-04-19 10:16:00 WARN [BasicResourcePool] com.mchange.v2.resourcepool.BasicResourcePool@74f26dc -- Acquisition Attempt Failedclear! Clearing pending acquires. While trying to acquire a needed new resource, we failed to succeed more than the maximum number of allowed acquisition attempts (30)."
```
for that input. The remainder of the file is being accumulated in another event and waiting for another line that matches %{DATE\_EU} to trigger it being flushed.
You could use the auto\_flush\_interval to flush the event if no such line occurs after a certain number of seconds.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 6, 2019, 1:38pm UTC](https://discuss.elastic.co/t/parsing-multiline-tomcat-logs/178874/4 "2019-06-06T13:38:18Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.