# Scripted fields not working on multiline Events

**URL:** <https://discuss.elastic.co/t/scripted-fields-not-working-on-multiline-events/236554>\
**Category:** Elasticsearch\
**Created:** [June 10, 2020, 4:55pm UTC](https://discuss.elastic.co/t/scripted-fields-not-working-on-multiline-events/236554 "2020-06-10T16:55:53Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![amityadav](https://avatars.discourse-cdn.com/v4/letter/a/ba8739/32.png) [@amityadav](https://discuss.elastic.co/u/amityadav)\
**Post date:** [June 10, 2020, 4:55pm UTC](https://discuss.elastic.co/t/scripted-fields-not-working-on-multiline-events/236554/1 "2020-06-10T16:55:54Z")

</div>

I am using multiline codec in my logstash config file in input section to merge few lines of log file. Lines 5,6,7,8,9 are getting merged into a single line and the same is visible in Kibana screen for message and sub\_class fields(refer config file).  
My requirement is to read the week consumption and month consumption and show it in new scripted field Consumption Data. I am not able to get any value for the merged line using scripted field.  
I used below script and received ‘Value not present, for the merged line and ‘Value Present’ for all other lines.  
Script -  
if(doc['sub\_class.keyword'].size()==0) return 'Value not present'; else return 'Value Present';

Log File -

1. 2020/05/12\_09:25:04,Attr 0x0000
2. 2020/05/12\_09:25:04, Attr 0x0000
3. 2020/05/12\_09:25:04, Attr 0x0000
4. 2020/05/12\_09:25:04, Attr 0x0000
5. 2020/05/12\_09:25:04, Daily Consumption report received
6. 2020/05/12\_09:25:04,Current week consumption was 100 (avail=1)
7. 2020/05/12\_09:25:04,Day is not Monday, so add current day into current week
8. 2020/05/12\_09:25:04,Current month consumption was 5000 (avail=1)
9. 2020/05/12\_09:25:04,Day is not Monday, so add current day into current week
10. 2020/05/12\_09:25:04, Attr 0x0000
11. 2020/05/12\_09:25:04, Attr 0x0000
12. 2020/05/12\_09:25:04, Attr 0x0000

Logstash Config file -  
input {  
file {  
path =\> ["---------------------------------/WHOHealth.txt"]  
start\_position =\> "beginning"  
sincedb\_path =\> "NUL"   
codec =\> multiline {  
pattern =\> "(^.+Current week .+)|(^.+Day is .+)|(^.+Current month.+)”  
what =\> "previous"  
negate =\> "false"  
}   
}  
}  
filter {  
if ([message] =~ "{"index") {  
drop {}  
} else if ([message] =~ "month") {  
grok {  
match =\> {"message" =\> "%{GREEDYDATA:log\_line}"}  
}  
mutate {  
add\_field =\> { "sub\_class" =\> "%{[log\_line]}" }  
}  
}

}  
output {  
elasticsearch {  
hosts =\> ["[http://localhost:9200](http://localhost:9200)"]  
index =\> "TestIndex"  
}  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 8, 2020, 4:55pm UTC](https://discuss.elastic.co/t/scripted-fields-not-working-on-multiline-events/236554/2 "2020-07-08T16:55:54Z")

</div>

Closed on July 8, 2020, 4:55pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.