# Solution for multiple patterns for multiline configuration

**URL:** <https://discuss.elastic.co/t/solution-for-multiple-patterns-for-multiline-configuration/43807>\
**Category:** Logstash\
**Created:** [March 8, 2016, 4:49pm UTC](https://discuss.elastic.co/t/solution-for-multiple-patterns-for-multiline-configuration/43807 "2016-03-08T16:49:10Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Marine](https://avatars.discourse-cdn.com/v4/letter/m/45deac/32.png) [@Marine](https://discuss.elastic.co/u/Marine)\
**Post date:** [March 8, 2016, 4:49pm UTC](https://discuss.elastic.co/t/solution-for-multiple-patterns-for-multiline-configuration/43807/1 "2016-03-08T16:49:10Z")

</div>

In the multiline documentation the setting "pattern" is a string and it's not possible to put an array of patterns, but I have a really hard logfile to parse and I need to do something similar.

I have two type of logs in the SAME FILE and sometimes they are on multiple lines as following :

```
2016-02-16 17:25:35,241 foo foo foo foo
        foo foo foo foo
        foo foo foo foo
        foo foo foo foo
        foo foo foo foo
Wed Feb 17 09:59:28 CET 2016 foo foo foo foo
        foo foo foo foo
        foo foo foo foo
        foo foo foo foo

```

I tried to do two multiline or something as following but without sucess :

```
 multiline{
      pattern => "((^%{TIMESTAMP_ISO8601}%{SPACE})|(^%{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{WORD} %{YEAR}))"
      what => "previous"
      negate => true
    }

```

How can I do a multiline codec matching my logs on multiple lines ?

Thanks

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 9, 2016, 8:56pm UTC](https://discuss.elastic.co/t/solution-for-multiple-patterns-for-multiline-configuration/43807/2 "2016-03-09T20:56:02Z")

</div>

There's probably a small error in your expression. I don't see why an expression on the form `^(expr1|expr2)` wouldn't work.

---

<div class="post-metadata">

**Author:** ![Marine](https://avatars.discourse-cdn.com/v4/letter/m/45deac/32.png) [@Marine](https://discuss.elastic.co/u/Marine)\
**Post date:** [March 10, 2016, 12:47pm UTC](https://discuss.elastic.co/t/solution-for-multiple-patterns-for-multiline-configuration/43807/3 "2016-03-10T12:47:51Z")

</div>

@magnusbaeck Yes thank you, I changed my expression and it's working now 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:07am UTC](https://discuss.elastic.co/t/solution-for-multiple-patterns-for-multiline-configuration/43807/4 "2017-07-06T05:07:33Z")

</div>