# Question about Multiline codec in combining the lines

**URL:** <https://discuss.elastic.co/t/question-about-multiline-codec-in-combining-the-lines/42360>\
**Category:** Logstash\
**Created:** [February 22, 2016, 6:59am UTC](https://discuss.elastic.co/t/question-about-multiline-codec-in-combining-the-lines/42360 "2016-02-22T06:59:14Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![guojingjing](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guojingjing/32/8205_2.png) [@guojingjing](https://discuss.elastic.co/u/guojingjing)\
**Post date:** [February 22, 2016, 6:59am UTC](https://discuss.elastic.co/t/question-about-multiline-codec-in-combining-the-lines/42360/1 "2016-02-22T06:59:14Z")

</div>

I have a fake data file:  
ST 1  
EN 1  
ST 2  
EN 2  
ST 3  
EN 3

My config file is  
input {  
stdin {}  
file {  
# type =\> "tomcat"  
path =\> "C:\1LOGS\XXX\data\fakedata4.log"  
start\_position =\> beginning  
codec =\> multiline {  
pattern =\> "^SR"  
negate =\> "true"  
what =\> "previous"  
}  
}  
}  
output {  
stdout{codec =\> rubydebug}  
}

but then the output only shows the first two events  
Logstash startup completed  
{  
"@timestamp" =\> "2016-02-22T06:54:55.137Z",  
"message" =\> "SR 1\r\nEN 1\r",  
"@version" =\> "1",  
"tags" =\> [  
[0] "multiline"  
],  
"path" =\> "C:\1LOGS\XXX\data\fakedata4.log",  
"host" =\> "XXXX"  
}  
{  
"@timestamp" =\> "2016-02-22T06:54:55.139Z",  
"message" =\> "SR 2\r\nEN 2\r",  
"@version" =\> "1",  
"tags" =\> [  
[0] "multiline"  
],  
"path" =\> "C:\1LOGS\XXX\data\fakedata4.log",  
"host" =\> "XXXX"  
}

Q: why did the multi-line codec plugin seem to stop before SR 3?

Thanks!

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 23, 2016, 6:59pm UTC](https://discuss.elastic.co/t/question-about-multiline-codec-in-combining-the-lines/42360/2 "2016-02-23T18:59:54Z")

</div>

> I have a fake data file:  
> ST 1  
> EN 1  
> ST 2  
> EN 2  
> ST 3  
> EN 3

Judging by the rest of your post I'm going to assume you meant "SR" instead of "ST".

> Q: why did the multi-line codec plugin seem to stop before SR 3?

Because it's still waiting for the next non-SR line. It can't flush the currently built-up lines until it sees an SR lines that signals that a new sequence of lines begins.

---

<div class="post-metadata">

**Author:** ![ggajanan](https://avatars.discourse-cdn.com/v4/letter/g/838e76/32.png) [@ggajanan](https://discuss.elastic.co/u/ggajanan)\
**Post date:** [June 6, 2016, 4:15pm UTC](https://discuss.elastic.co/t/question-about-multiline-codec-in-combining-the-lines/42360/3 "2016-06-06T16:15:47Z")

</div>

Hi,

New to ELK stack, multiline filter works for me but i saw it is not thread safe as well as deprecated. So is there an alternate way to overcome this problem of not flushing the last line from the log file? I am currently using logstash-2.3.2 with 'file' input type to analyse the logs files. Please suggest.

Thank you!

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 8, 2016, 5:57pm UTC](https://discuss.elastic.co/t/question-about-multiline-codec-in-combining-the-lines/42360/4 "2016-06-08T17:57:40Z")

</div>

The multiline _codec_ doesn't work?

---

<div class="post-metadata">

**Author:** ![ggajanan](https://avatars.discourse-cdn.com/v4/letter/g/838e76/32.png) [@ggajanan](https://discuss.elastic.co/u/ggajanan)\
**Post date:** [June 20, 2016, 2:22pm UTC](https://discuss.elastic.co/t/question-about-multiline-codec-in-combining-the-lines/42360/5 "2016-06-20T14:22:07Z")

</div>

Yes using multiline _codec_ but it is not flushing the last line of the log file. When I shut down the logstash, then it processes the last line.

---

<div class="post-metadata">

**Author:** ![ggajanan](https://avatars.discourse-cdn.com/v4/letter/g/838e76/32.png) [@ggajanan](https://discuss.elastic.co/u/ggajanan)\
**Post date:** [June 22, 2016, 2:08pm UTC](https://discuss.elastic.co/t/question-about-multiline-codec-in-combining-the-lines/42360/6 "2016-06-22T14:08:54Z")

</div>

I moved over to filebeat and this problem went away because filebeat with the multiline setting is reading every line.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:51am UTC](https://discuss.elastic.co/t/question-about-multiline-codec-in-combining-the-lines/42360/7 "2017-07-06T04:51:09Z")

</div>