# Processing multiline data

**URL:** <https://discuss.elastic.co/t/processing-multiline-data/73046>\
**Category:** Logstash\
**Created:** [January 27, 2017, 5:09pm UTC](https://discuss.elastic.co/t/processing-multiline-data/73046 "2017-01-27T17:09:36Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![pajesz](https://avatars.discourse-cdn.com/v4/letter/p/919ad9/32.png) [@pajesz](https://discuss.elastic.co/u/pajesz)\
**Post date:** [January 27, 2017, 5:09pm UTC](https://discuss.elastic.co/t/processing-multiline-data/73046/1 "2017-01-27T17:09:36Z")

</div>

Hello,

I want to process an exception log file but the problem is that the data is multiline with exception message, datetime etc in the first row and further random number of rows that is the stack trace. I want to pass a file containing such exeptions to logstash, but it passes it row by row. Is it possible to pass one exception as a unit?

DummyExample:  
InsufficientFundsException - 2017-01-27  
at Acc.withdraw(Whatever.java:25)  
at Bank.main(WhatIsThis.java:13)

Thanks,  
Best Regards

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [January 29, 2017, 9:29am UTC](https://discuss.elastic.co/t/processing-multiline-data/73046/2 "2017-01-29T09:29:55Z")

</div>

Always try to assemble the multiline messages as close to the source as possible. If you are using a file input in Logstash, you can use the [multiline codec](https://www.elastic.co/guide/en/logstash/current/plugins-codecs-multiline.html) to assemble messages as they are read.

---

<div class="post-metadata">

**Author:** ![pajesz](https://avatars.discourse-cdn.com/v4/letter/p/919ad9/32.png) [@pajesz](https://discuss.elastic.co/u/pajesz)\
**Post date:** [January 30, 2017, 7:00pm UTC](https://discuss.elastic.co/t/processing-multiline-data/73046/3 "2017-01-30T19:00:10Z")

</div>

Thank you very much that helped a lot. Should've read the documentation first. 😅

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 27, 2017, 7:00pm UTC](https://discuss.elastic.co/t/processing-multiline-data/73046/4 "2017-02-27T19:00:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.