I am parsing my own log file send to logstash. My log file looks like as below. 2018-02-01 12:01:59,574 receive 'AccountReady' is True. account is 12345. Current local time is 2018-02-01 12:01:59.574. Current UTC time is 2018-02-01 04:01:59.574. 2018-02-01 12:01:59,685 receive 'AccountReady' is True. account is 23456. Current local time is 2018-02-01 12:01:59.685. Current UTC time is 2018-02-01 04:01:59.685. 2018-02-01 12:01:59,710 receive 'AccountReady' is True. account is 34567. Current local time is 2018-02-01 12:01:59.710. Current UTC time is 2018-02-01 04:01:59.710. 2018-02-01 12:07:12,460 _Disconnect 2018-02-01 12:07:13,382 BeforeReConnect is triggered. 2018-02-01 12:07:14,449 AfterReConnec is triggered (It`s already reconnected.) 2018-02-01 12:07:14,451 Restart is not trigger because the connection is reconnected. I have many files like this. and the nxlog config looks like this <Extension multi> Module xm_multiline HeaderLine /^(\d{4}\-(0[1-9]|1[012])\-([0|1|2]\d|3[0|1]) ([0|1]\d|2[0-3])\:([0-5]\d)\:([0-5]\d),\d{3})/ </Extension> <Input aplogfile> Module im_file File "C:\\Code\\MyProj\\bin\\Debug\\Logs\\*.*" SavePos TRUE ReadFromLast FALSE InputType multi </Input> <Output udp_logstash> Module om_udp Host 192.168.1.104 Port 12020 OutputType Dgram </Output> <Route 1> Path aplogfile => udp_logstash </Route> Most of these logs are parsed correctly, but some message are not . For example , the first two line should send as one message, but it send twice for first line and second line. This situation are only happened at first line in some files. Does anyone ever touched the same problem? Thanks!