# Test multiline codec

**URL:** <https://discuss.elastic.co/t/test-multiline-codec/164451>\
**Category:** Logstash\
**Created:** [January 16, 2019, 11:26am UTC](https://discuss.elastic.co/t/test-multiline-codec/164451 "2019-01-16T11:26:52Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![imaad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/imaad/32/48628_2.png) [@imaad](https://discuss.elastic.co/u/imaad)\
**Post date:** [January 16, 2019, 11:26am UTC](https://discuss.elastic.co/t/test-multiline-codec/164451/1 "2019-01-16T11:26:52Z")

</div>

Hello,

This is my configuration file :

```
input {
  file {
    path => "/usr/share/logstash/testmultiline.log"
    start_position => "beginning"
    #type => "log"
    sincedb_path => "/dev/null"
    codec => multiline {
      pattern => "^%{TIMESTAMP_ISO8601}"
      what => "previous"
    }
  }
}
output{
    stdout {codec => rubydebug }
}

```

The log file look like this :

```
2018-12-13T11:46:13.654+0000 Regulatory [INFO] Transaction : VALIDATE,FT18260HNC8R1bbcffrlnrt21x8awmxhtjfdz,FT18260HNC8R,100002506,13/12/2018,13/12/2018T11:46:13.243+0000,null,Payment Order,Date not a working day
2018-12-13T11:41:44.846+0000 Regulatory [INFO] Transaction : VALIDATE,qf16ft787bif1xs1iuoqihwi9,null,100002506,13/12/2018,13/12/2018T11:41:42.447+0000,null,Payment Order,Date not a working day
2018-12-13T12:07:41.644+0000 Regulatory [INFO] Transaction : VALIDATE,007069643021retfed8ar2w4ugvgz1n9xsuz,0070696430.2,100002506,13/12/2018,13/12/2018T12:07:39.905+0000,null,Payment Order,None
2018-12-13T13:13:22.449+0000 Regulatory [INFO] Transaction : VALIDATE,0004961017bb48fydx3gvq1dopa7tujzoya,0004961017,100002506,13/12/2018,13/12/2018T13:13:21.700+0000,null,Payment Order,Invalid end date

```

My goal is to specify that any line which begin with a timestamp have to belong to the previous line. The codec rubydebug doesn't show me anything, I don't know if the multiline works or not. How can I print my event? Is my event null that's why the codec doesn't show anything?

Thank you.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [January 16, 2019, 11:45am UTC](https://discuss.elastic.co/t/test-multiline-codec/164451/2 "2019-01-16T11:45:07Z")

</div>

I am not sure I understand what you are trying to achieve. What output would you expect based on the sample data you provided where all lines have the same structure?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 24, 2019, 2:04pm UTC](https://discuss.elastic.co/t/test-multiline-codec/164451/5 "2019-01-24T14:04:50Z")

</div>

That multiline pattern cannot emit an event until it finds a line that does not start with the pattern. So if you append a line that does not start with the pattern it should work. Alternatively, use the auto\_flush\_interval option.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 21, 2019, 2:04pm UTC](https://discuss.elastic.co/t/test-multiline-codec/164451/6 "2019-02-21T14:04:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.