# Random newlines when using multiline-codec in tcp input

**URL:** <https://discuss.elastic.co/t/random-newlines-when-using-multiline-codec-in-tcp-input/160321>\
**Category:** Logstash\
**Created:** [December 11, 2018, 8:33am UTC](https://discuss.elastic.co/t/random-newlines-when-using-multiline-codec-in-tcp-input/160321 "2018-12-11T08:33:55Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![shkwarka](https://avatars.discourse-cdn.com/v4/letter/s/f08c70/32.png) [@shkwarka](https://discuss.elastic.co/u/shkwarka)\
**Post date:** [December 11, 2018, 8:33am UTC](https://discuss.elastic.co/t/random-newlines-when-using-multiline-codec-in-tcp-input/160321/1 "2018-12-11T08:33:55Z")

</div>

Hello,

I'm trying to process multiline messages received from rsyslog as a plain text over TCP with multiline codec in **tcp input**. In output for some messages i noticed parsing failed because Logstash inserted randomly "\n" inside of the message. Logstash v6.5

Output example:

`{"message":"271 &lt;143&gt;1 2018-12-10T07:57:38.891Z [testhost.my.net](http://testhost.my.net) evr 14025 acc - xx.xx.xxx.xxx - - [10/Dec/2018:07:57:38 +0000] \"POST /api/authsessions?currentSessionId=CE6E10EF014314E3DA085023\n478E94AE HTTP/1.1\" 200 - \"requestTimestamp=1544428658868;responseTimestamp=1544428658891;\"","@version":"1","port":xxxxx,"host":"xx.xx.xxx.xxx","@timestamp":"2018-12-10T07:57:38.996Z","tags":["multiline"],"type":"rfc5424"}`

Logstash config:

```
input {
  tcp {
    host => "0.0.0.0"
    port => 20514
    type => "rfc5424"
    codec => multiline {
      pattern => "^%{NONNEGINT}%{SPACE}<%{NONNEGINT}>"
      negate => true
      what => "previous"
      auto_flush_interval => 1
     }
  }
}
filter {
        if [type] == "rfc5424" {
         grok {
            match => {"message" => "<%{NONNEGINT:syslog_pri}>%{NONNEGINT:version}%{SPACE}(?:-|%{TIMESTAMP_ISO8601:syslog_timestamp})%{SPACE}(?:-|%{IPORHOST:hostname})%{SPACE}(?:%{SYSLOG5424PRINTASCII:env_name}|-)%{SPACE}(?:-|%{SYSLOG5424PRINTASCII:process_id})%{SPACE}(?:-|%{SYSLOG5424PRINTASCII:logtype})%{SPACE}(?:-|(?<structured_data>(\[.*?[^\\]\])+))(?:%{SPACE}%{GREEDYDATA:MSG}|)"
            }
        }
      }
}
output {
    stdout { codec => rubydebug }
    elasticsearch {
        hosts => ["127.0.0.1:9200"]
        index => "test5-%{+YYYY.MM.dd}"
    }
}

```

Rsyslog config

```
action(Name="logstash-01"
                  Type="omfwd"
                  Target="xx.xx.xx.xx"
                  Port="20514"
                  Protocol="tcp"
                  Tcp_framing="octet-counted"
                      Template="RFC5424"
        )

```

I searched for similar topics but still haven't find the solution

> <https://github.com/logstash-plugins/logstash-codec-multiline/issues/37>

  

> <https://github.com/logstash-plugins/logstash-codec-multiline/pull/63>

---

<div class="post-metadata">

**Author:** ![xeraa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xeraa/32/48181_2.png) [@xeraa](https://discuss.elastic.co/u/xeraa)\
**Post date:** [December 13, 2018, 3:10pm UTC](https://discuss.elastic.co/t/random-newlines-when-using-multiline-codec-in-tcp-input/160321/2 "2018-12-13T15:10:17Z")

</div>

Have you tried [https://github.com/logstash-plugins/logstash-codec-multiline/pull/63#issuecomment-430401073](https://github.com/logstash-plugins/logstash-codec-multiline/pull/63#issuecomment-430401073) and did that work for you? I'm curious if there could be some additional validation for that PR.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 10, 2019, 3:10pm UTC](https://discuss.elastic.co/t/random-newlines-when-using-multiline-codec-in-tcp-input/160321/3 "2019-01-10T15:10:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.