🚨 Logstash Error: 'Multiline codec with beats input is not supported' — Cause, Fix, and Troubleshooting Guide

Overview

The beats input receives events that Filebeat has already framed and batched over the Lumberjack protocol. Because those events arrive as discrete, pre-assembled messages, you cannot attach a multiline codec to the beats input to re-stitch them — the two models are incompatible. Logstash 6+ rejects this at startup with a fatal configuration error and refuses to run:

[FATAL][logstash.runner ] An unexpected error occurred! {:error=>#<LogStash::ConfigurationError: Multiline codec with beats input is not supported. Please use the multiline codec in Filebeat.>, ...}

This is a hard stop, not a warning. The whole process exits, so no pipelines start. The message is also prescriptive: multiline reassembly must happen where the lines are still a stream — either in Filebeat (before events are shipped), or with a multiline codec on a file input if Logstash is tailing files directly. It cannot happen on the beats input.

Symptoms

• Logstash exits immediately at startup; logstash-plain.log ends with [FATAL][logstash.runner].
• The error text is LogStash::ConfigurationError: Multiline codec with beats input is not supported. Please use the multiline codec in Filebeat.
• systemctl status logstash shows the service failed/exited rather than running.
• The offending pipeline has a beats {} block with a codec => multiline { ... }.
• Stack traces and multi-line app logs were previously arriving as one event (via a file input) and broke after switching to Filebeat + beats.

Common Root Causes

• A multiline codec on the beats input — the direct cause; copied from a file-input config where it was valid.
• Migrating from file to beats — a working file input using codec => multiline was replaced with a beats input but the codec was carried over.
• Assuming Logstash should stitch stack traces — the reassembly was placed in Logstash instead of Filebeat, where the raw lines actually originate.
• Config templated across input types — a shared template applied a multiline codec uniformly to every input, including beats.

How to diagnose

Validate the config with -t; this fatal error is caught during config parsing, so --config.test_and_exit reproduces it without starting the service:

sudo -u logstash /usr/share/logstash/bin/logstash \
  -f /etc/logstash/conf.d/ \
  --config.test_and_exit --path.settings /etc/logstash
# ConfigurationError: Multiline codec with beats input is not supported.

Find the offending block. Grep the pipeline configs for a multiline codec attached anywhere near a beats input:

grep -rn -e 'beats' -e 'multiline' /etc/logstash/conf.d/

The broken configuration looks like this — a multiline codec on the beats input, which Logstash rejects:

input {
  beats {
    port => 5044
    codec => multiline {         # <- illegal on a beats input
      pattern => "^\s"
      what => "previous"
    }
  }
}

Fixes

Remove the codec from the beats block. The beats input should receive already-framed events with no multiline codec:

input {
  beats {
    port => 5044
    client_inactivity_timeout => 60
  }
}

Move the multiline logic into Filebeat, where the log lines are still an unframed stream. Reassemble stack traces there so each event Filebeat ships is already one complete record:

# filebeat.yml — join continuation lines into the preceding event
filebeat.inputs:
  - type: filestream
    id: app-logs
    paths:
      - /var/log/app/*.log
    parsers:
      - multiline:
          type: pattern
          pattern: '^[[:space:]]'   # lines starting with whitespace are continuations
          negate: false
          match: after

output.logstash:
  hosts: ["logstash.internal:5044"]

If Logstash tails files directly (no Filebeat in the path), the multiline codec is valid — but on a file input, not beats:

input {
  file {
    path => "/var/log/app/*.log"
    codec => multiline {
      pattern => "^\s"
      what => "previous"
    }
  }
}

What to watch out for

• Do the multiline join in exactly one place. If Filebeat stitches events and Logstash tries to as well, you either double-join or hit this fatal error — pick the layer closest to the raw lines.
• negate/match semantics differ from the codec. Filebeat uses pattern/negate/match; the Logstash codec uses pattern/what. Translate carefully so continuation lines attach to the right event.
• This is a startup-fatal error. Nothing ingests until it is fixed; treat it as an outage, not a warning to clean up later.
• Watch for over-greedy patterns. A multiline pattern that matches too much will merge unrelated log entries into giant events — test against real logs.
• client_inactivity_timeout is unrelated but useful. While editing the beats block, set it so idle Filebeat connections are reaped cleanly.

Related

• Logstash beats input ‘Connection reset by peer’
• Logstash beats input pipeline blocked
• Logstash ‘different character encoding’ warnings