# Recover only a part of a log with multiline codec

**URL:** https://discuss.elastic.co/t/recover-only-a-part-of-a-log-with-multiline-codec/42824
**Category:** Logstash
**Created:** [February 26, 2016, 8:35am UTC](https://discuss.elastic.co/t/recover-only-a-part-of-a-log-with-multiline-codec/42824 "2016-02-26T08:35:55Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Justin\_V](https://avatars.discourse-cdn.com/v4/letter/j/fbc32d/32.png) [@Justin\_V](https://discuss.elastic.co/u/Justin_V)
#### Post date: [February 26, 2016, 8:35am UTC](https://discuss.elastic.co/t/recover-only-a-part-of-a-log-with-multiline-codec/42824/1 "2016-02-26T08:35:55Z")

</div>

Hello again,

I'm now having trouble with some particular logs.

 ![](https://us1.discourse-cdn.com/elastic/original/2X/3/3d6b3c2501fdb928957523f4b65fd57cf9a7b7b6.png)

As you can see, these are "multiline" logs : the message is continuing in the next lines. But (as you can see too), they start _again_ with the same pattern.

What I've done :  
I've determined this multiline codec :

> codec =\> multiline{  
> patterns\_dir =\> "./patterns"  
> pattern =\> "^%{TIMESTAMP\_ISO8601} %{POSINT} %{LOGLEVEL} (?:%{USERNAME}|?) %{PROG}: {1}"  
> negate =\> true  
> what =\> previous  
> }

So if there are more than one blank space after the pattern, it's part of the previous log.  
But here's the problem : How can I say to logstash to only take what is _after_ the pattern ?  
I've tried, and it give me something pretty weird.

Thanks in advance for the help.

---

<div class="post-metadata">

### Author: ![Roy\_K](https://avatars.discourse-cdn.com/v4/letter/r/90ced4/32.png) [@Roy\_K](https://discuss.elastic.co/u/Roy_K)
#### Post date: [February 26, 2016, 3:33pm UTC](https://discuss.elastic.co/t/recover-only-a-part-of-a-log-with-multiline-codec/42824/2 "2016-02-26T15:33:58Z")

</div>

I think you are looking for something like this. Obviously I cannot test this. But I am doing something similar, where anything not starting with a datestamp in the specific format is multiline. Work fine for my logs.  
`multiline { pattern => "%{TIMESTAMP_ISO8601} %{POSINT} %{LOGLEVEL} (?:%{USERNAME}|\?) %{PROG}:\s" negate => true what => "previous" }`  
Here is my working code. I modified this to attempt to make yours work.  
`  
multiline {  
pattern =\> "[%{DAY}-%{MONTHNUM}-%{MONTHDAY} %{TIME},"  
negate =\> true  
what =\> "previous"  
}

`

---

<div class="post-metadata">

### Author: ![Justin\_V](https://avatars.discourse-cdn.com/v4/letter/j/fbc32d/32.png) [@Justin\_V](https://discuss.elastic.co/u/Justin_V)
#### Post date: [February 26, 2016, 3:55pm UTC](https://discuss.elastic.co/t/recover-only-a-part-of-a-log-with-multiline-codec/42824/3 "2016-02-26T15:55:40Z")

</div>

As I said to you in your post : reverse effect. My issue is probably only my pattern, and I will find what i've done wrong

---

<div class="post-metadata">

### Author: ![Justin\_V](https://avatars.discourse-cdn.com/v4/letter/j/fbc32d/32.png) [@Justin\_V](https://discuss.elastic.co/u/Justin_V)
#### Post date: [February 29, 2016, 12:56pm UTC](https://discuss.elastic.co/t/recover-only-a-part-of-a-log-with-multiline-codec/42824/4 "2016-02-29T12:56:17Z")

</div>

I changed the end of my regex from " {1}" to " %{NOTSPACE}". It works again, but everything is concatenated dumbly.  
I didn't find the equivalent of "stream\_identity" in codec, so I'm stuck again.  
Need help, anyone please

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:09am UTC](https://discuss.elastic.co/t/recover-only-a-part-of-a-log-with-multiline-codec/42824/5 "2017-07-06T05:09:20Z")

</div>