# Syslog Input Multiline Fail **URL:** \ **Category:** Logstash\ **Created:** [February 9, 2018, 2:17pm UTC](https://discuss.elastic.co/t/syslog-input-multiline-fail/119253 "2018-02-09T14:17:58Z")\ **Posts on this page:** 1\ **Showing post:** 2
**Author:** ![htechno](https://avatars.discourse-cdn.com/v4/letter/h/8491ac/32.png) [@htechno](https://discuss.elastic.co/u/htechno)\ **Post date:** [February 12, 2018, 10:47am UTC](https://discuss.elastic.co/t/syslog-input-multiline-fail/119253/2 "2018-02-12T10:47:52Z")
Hi there, I try to figure it out by including debug logs. Here's what I see: The multiline codec is loaded. ``` [2018-02-12T13:30:15,390][DEBUG][logstash.codecs.multiline] config LogStash::Codecs::Multiline/@pattern = "<31>%{SYSLOGTIMESTAMP} %{WORD}\\s{5}%{WORD}" [2018-02-12T13:30:15,390][DEBUG][logstash.codecs.multiline] config LogStash::Codecs::Multiline/@what = "previous" [2018-02-12T13:30:15,390][DEBUG][logstash.codecs.multiline] config LogStash::Codecs::Multiline/@id = "2b3d2bb0-01f0-4d00-a101-d77830cf103d" [2018-02-12T13:30:15,390][DEBUG][logstash.codecs.multiline] config LogStash::Codecs::Multiline/@enable_metric = true [2018-02-12T13:30:15,390][DEBUG][logstash.codecs.multiline] config LogStash::Codecs::Multiline/@negate = false [2018-02-12T13:30:15,390][DEBUG][logstash.codecs.multiline] config LogStash::Codecs::Multiline/@patterns_dir = [] [2018-02-12T13:30:15,390][DEBUG][logstash.codecs.multiline] config LogStash::Codecs::Multiline/@charset = "UTF-8" [2018-02-12T13:30:15,390][DEBUG][logstash.codecs.multiline] config LogStash::Codecs::Multiline/@multiline_tag = "multiline" [2018-02-12T13:30:15,390][DEBUG][logstash.codecs.multiline] config LogStash::Codecs::Multiline/@max_lines = 500 [2018-02-12T13:30:15,391][DEBUG][logstash.codecs.multiline] config LogStash::Codecs::Multiline/@max_bytes = 10485760 ``` The codec takes strings and correctly parses them. ``` [2018-02-12T13:41:59,025][DEBUG][logstash.codecs.multiline] Multiline {:pattern=>"<31>%{SYSLOGTIMESTAMP} %{WORD}\\s{5}%{WORD}", :text=>"<31>Feb 12 13:41:59 X5_tihvinskaya3 sending Accounting-Request with id 48 to 185.12.28.167:1813", :match=>false, :negate=>false} [2018-02-12T13:41:59,026][DEBUG][logstash.codecs.multiline] Multiline {:pattern=>"<31>%{SYSLOGTIMESTAMP} %{WORD}\\s{5}%{WORD}", :text=>"<31>Feb 12 13:41:59 X5_tihvinskaya3 Signature = 0xfd4b666fe587c339551d5bb83e47749c", :match=>true, :negate=>false} [2018-02-12T13:41:59,026][DEBUG][logstash.codecs.multiline] Multiline {:pattern=>"<31>%{SYSLOGTIMESTAMP} %{WORD}\\s{5}%{WORD}", :text=>"<31>Feb 12 13:41:59 X5_tihvinskaya3 Acct-Status-Type = 2", :match=>true, :negate=>false} [2018-02-12T13:41:59,026][DEBUG][logstash.codecs.multiline] Multiline {:pattern=>"<31>%{SYSLOGTIMESTAMP} %{WORD}\\s{5}%{WORD}", :text=>"<31>Feb 12 13:41:59 X5_tihvinskaya3 Acct-Terminate-Cause = 6", :match=>true, :negate=>false} [2018-02-12T13:41:59,026][DEBUG][logstash.codecs.multiline] Multiline {:pattern=>"<31>%{SYSLOGTIMESTAMP} %{WORD}\\s{5}%{WORD}", :text=>"<31>Feb 12 13:41:59 X5_tihvinskaya3 NAS-Port-Type = 19", :match=>true, :negate=>false} [2018-02-12T13:41:59,027][DEBUG][logstash.codecs.multiline] Multiline {:pattern=>"<31>%{SYSLOGTIMESTAMP} %{WORD}\\s{5}%{WORD}", :text=>"<31>Feb 12 13:41:59 X5_tihvinskaya3 Calling-Station-Id = \"9C:35:EB:E4:F0:F5\"", :match=>true, :negate=>false} [2018-02-12T13:41:59,027][DEBUG][logstash.codecs.multiline] Multiline {:pattern=>"<31>%{SYSLOGTIMESTAMP} %{WORD}\\s{5}%{WORD}", :text=>"<31>Feb 12 13:41:59 X5_tihvinskaya3 Called-Station-Id = \"X5_tihvinskaya3\"", :match=>true, :negate=>false} ``` But the filter receives separate non-merged events. ``` [2018-02-12T13:41:59,132][DEBUG][logstash.pipeline] filter received {"event"=>{"@version"=>"1", "@timestamp"=>2018-02-12T10:41:59.026Z, "host"=>"10.147.99.3", "message"=>"<31>Feb 12 13:41:59 X5_tihvinskaya3 sending Accounting-Request with id 48 to 185.12.28.167:1813"}} [2018-02-12T13:41:59,132][DEBUG][logstash.pipeline] filter received {"event"=>{"@version"=>"1", "@timestamp"=>2018-02-12T10:41:59.026Z, "host"=>"10.147.99.3", "message"=>"<31>Feb 12 13:41:59 X5_tihvinskaya3 Signature = 0xfd4b666fe587c339551d5bb83e47749c"}} [2018-02-12T13:41:59,132][DEBUG][logstash.pipeline] filter received {"event"=>{"@version"=>"1", "@timestamp"=>2018-02-12T10:41:59.026Z, "host"=>"10.147.99.3", "message"=>"<31>Feb 12 13:41:59 X5_tihvinskaya3 Acct-Status-Type = 2"}} [2018-02-12T13:41:59,132][DEBUG][logstash.pipeline] filter received {"event"=>{"@version"=>"1", "@timestamp"=>2018-02-12T10:41:59.027Z, "host"=>"10.147.99.3", "message"=>"<31>Feb 12 13:41:59 X5_tihvinskaya3 Acct-Terminate-Cause = 6"}} [2018-02-12T13:41:59,132][DEBUG][logstash.pipeline] filter received {"event"=>{"@version"=>"1", "@timestamp"=>2018-02-12T10:41:59.027Z, "host"=>"10.147.99.3", "message"=>"<31>Feb 12 13:41:59 X5_tihvinskaya3 NAS-Port-Type = 19"}} [2018-02-12T13:41:59,132][DEBUG][logstash.pipeline] filter received {"event"=>{"@version"=>"1", "@timestamp"=>2018-02-12T10:41:59.027Z, "host"=>"10.147.99.3", "message"=>"<31>Feb 12 13:41:59 X5_tihvinskaya3 Calling-Station-Id = \"9C:35:EB:E4:F0:F5\""}} [2018-02-12T13:41:59,132][DEBUG][logstash.pipeline] filter received {"event"=>{"@version"=>"1", "@timestamp"=>2018-02-12T10:41:59.027Z, "host"=>"10.147.99.3", "message"=>"<31>Feb 12 13:41:59 X5_tihvinskaya3 Called-Station-Id = \"X5_tihvinskaya3\""}} ``` Has anyone encountered such a codec behavior? --- _[View the full topic](https://discuss.elastic.co/t/syslog-input-multiline-fail/119253)._