# Beat multiline on XML does not send full event and tears up into individual lines

**URL:** <https://discuss.elastic.co/t/beat-multiline-on-xml-does-not-send-full-event-and-tears-up-into-individual-lines/251020>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [October 5, 2020, 3:39pm UTC](https://discuss.elastic.co/t/beat-multiline-on-xml-does-not-send-full-event-and-tears-up-into-individual-lines/251020 "2020-10-05T15:39:59Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![thdesy](https://avatars.discourse-cdn.com/v4/letter/t/71e660/32.png) [@thdesy](https://discuss.elastic.co/u/thdesy)\
**Post date:** [October 5, 2020, 3:39pm UTC](https://discuss.elastic.co/t/beat-multiline-on-xml-does-not-send-full-event-and-tears-up-into-individual-lines/251020/1 "2020-10-05T15:39:59Z")

</div>

Hi,

I have put a prospector onto a logfile [1], that is written as XML. An events is wrapped in tags, so I defined a multiline for the beat

```
  multiline:
    type: pattern
    pattern: '<c>'
    negate: true
    match: after

```

matching on '' and taking everything from there to (already tried to go before and revert the matching)

However, the events I see on my logstash node as receiver are all one event per line, i.e.,

```
"message": " <a n=\"RunRemoteUsage\"><s>Usr 0 00:00:29, Sys 0 00:00:13</s></a>"
.../next event/...
"message": " <a n=\"TotalLocalUsage\"><s>Usr 0 00:00:00, Sys 0 00:00:00</s></a>"
.../next event/...

```

So, I am looking for the bug, why the events are not send as 'proper' multiline events?  
Maybe somebody has an idea for me, what I have been missing ehre?

Cheers and thanks,  
Thomas

[1]

```
<c>
     <a n="TriggerEventTypeName"><s>ULOG_EXECUTE</s></a>
     <a n="Proc"><i>0</i></a>
     <a n="Subproc"><i>0</i></a>
     <a n="EventTypeNumber"><i>28</i></a>
</c>
<c>
    <a n="RunRemoteUsage"><s>Usr 1 05:36:14, Sys 0 01:51:08</s></a>
    <a n="TotalLocalUsage"><s>Usr 0 00:00:00, Sys 0 00:00:00</s></a>
    <a n="ReturnValue"><i>0</i></a>
    <a n="RunLocalUsage"><s>Usr 0 00:00:00, Sys 0 00:00:00</s></a>
</c>
<c>
    <a n="RunRemoteUsage"><s>Usr 0 00:02:57, Sys 0 00:01:18</s></a>
    <a n="TotalLocalUsage"><s>Usr 0 00:00:00, Sys 0 00:00:00</s></a>
    <a n="TotalReceivedBytes"><r>0.0</r></a>
</c>
```

---

<div class="post-metadata">

**Author:** ![thdesy](https://avatars.discourse-cdn.com/v4/letter/t/71e660/32.png) [@thdesy](https://discuss.elastic.co/u/thdesy)\
**Post date:** [October 7, 2020, 1:46pm UTC](https://discuss.elastic.co/t/beat-multiline-on-xml-does-not-send-full-event-and-tears-up-into-individual-lines/251020/2 "2020-10-07T13:46:54Z")

</div>

it was a typo -☹

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 4, 2020, 3:47pm UTC](https://discuss.elastic.co/t/beat-multiline-on-xml-does-not-send-full-event-and-tears-up-into-individual-lines/251020/3 "2020-11-04T15:47:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.