# Problem with codec multiline input
**URL:** https://discuss.elastic.co/t/problem-with-codec-multiline-input/125337
**Category:** Logstash
**Created:** [March 23, 2018, 9:43am UTC](https://discuss.elastic.co/t/problem-with-codec-multiline-input/125337 "2018-03-23T09:43:46Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@flochon](https://discuss.elastic.co/u/flochon)
#### Post date: [March 23, 2018, 9:43am UTC](https://discuss.elastic.co/t/problem-with-codec-multiline-input/125337/1 "2018-03-23T09:43:46Z")
I want parse my log multiline with the input of Logstash like this :
```auto
input {
beats {
port => 5443
if [message] =~ ".*---.*" {
codec => multiline {
multiline_tag => "MULTILINE"
pattern => "^.*\b([0-9]{4}-[0-9]{2}-[0-9]{2})\b.*"
negate => true
what => "next"
}
}
}
}
```
But I take this error
```auto
[2018-03-23T10:36:33,035][ERROR][logstash.agent] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, => at line 186, column 8 (byte 9302) after input {\n beats {\n port => 5443\n if ", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:42:in `compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:50:in `compile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:12:in `block in compile_sources'", "org/jruby/RubyArray.java:2486:in `map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in `compile_sources'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:51:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:169:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:40:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:315:in `block in converge_state'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:141:in `with_pipelines'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:312:in `block in converge_state'", "org/jruby/RubyArray.java:1734:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:299:in `converge_state'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:166:in `block in converge_state_and_update'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:141:in `with_pipelines'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:164:in `converge_state_and_update'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:90:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:348:in `block in execute'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:24:in `block in initialize'"]}
```
I use the 6.2.2 version.
I don't understand what is wrong. Perhaps the codec multiline don't work with the plugin Filebeat ?
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [March 23, 2018, 9:49am UTC](https://discuss.elastic.co/t/problem-with-codec-multiline-input/125337/2 "2018-03-23T09:49:48Z")
You always want to perform multiline processing as close to the source in order to ensure ordering of data is correct, so you should use the multiline functionality in Filebeat instead.
---
### Author:  [@flochon](https://discuss.elastic.co/u/flochon)
#### Post date: [March 23, 2018, 10:06am UTC](https://discuss.elastic.co/t/problem-with-codec-multiline-input/125337/3 "2018-03-23T10:06:49Z")
Is it possible to make a condition in filebeat like I make in the input of Logstash ?
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [March 23, 2018, 10:08am UTC](https://discuss.elastic.co/t/problem-with-codec-multiline-input/125337/4 "2018-03-23T10:08:00Z")
You can not have conditional with a plugin specification, so your Logstash config is invalid. Show what the data you are looking to process looks like and someone here may be able to help.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 20, 2018, 10:08am UTC](https://discuss.elastic.co/t/problem-with-codec-multiline-input/125337/5 "2018-04-20T10:08:28Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.