Multiline filter makes @timestamp and message become arrays



After upgrading from 1.3.3 to 1.4.0 the multiline filter transforms @timestamp and message into arrays. For example I have this two-lines log entry:

My multiline configuration is

The json representation of the log becomes:

Note that the multiline filter "works", but the message is not a string with "\n" like before. Is that a new feature ? How can we grok this message ? Thank you.


Jan Gaedicke
April 2, 2014, 1:08 PM

when using the elasticsearch-output this behaviour kills the logstash process.
I think this is critical to a lot of logstash users.

NoMethodError: undefined method `tv_sec' for #<Array:0x1c14ae29>
sprintf at /opt/logstash/lib/logstash/event.rb:223
gsub at org/jruby/
sprintf at /opt/logstash/lib/logstash/event.rb:209
receive at /opt/logstash/lib/logstash/outputs/elasticsearch.rb:324
handle at /opt/logstash/lib/logstash/outputs/base.rb:86
initialize at (eval):537
call at org/jruby/
output at /opt/logstash/lib/logstash/pipeline.rb:266
outputworker at /opt/logstash/lib/logstash/pipeline.rb:225
start_outputs at /opt/logstash/lib/logstash/pipeline.rb:152

Jan Gaedicke
April 2, 2014, 1:34 PM

I think this is a duplicate of

Fabien Baligand
April 6, 2014, 5:17 PM

I have exactly the same problem.
I have not this problem when using logstash 1.3.3.
This implies a blocking problem : the following filters are simply ignored (date, grok, ...)

April 15, 2014, 12:47 PM

Seems really to be a duplicate of

Philippe Weber
March 3, 2015, 5:55 AM


Colin Surprenant




Fix versions

Affects versions