# Beats apache module. Multiline to join PHP Stack trace **URL:** \ **Category:** Beats\ **Created:** [September 12, 2019, 7:46am UTC](https://discuss.elastic.co/t/beats-apache-module-multiline-to-join-php-stack-trace/199190 "2019-09-12T07:46:49Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![Martin\_Ostlund](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/martin_ostlund/32/53028_2.png) [@Martin\_Ostlund](https://discuss.elastic.co/u/Martin_Ostlund)\ **Post date:** [September 12, 2019, 7:46am UTC](https://discuss.elastic.co/t/beats-apache-module-multiline-to-join-php-stack-trace/199190/1 "2019-09-12T07:46:49Z")
Filebeat version: 7.3.1 OS: Ubuntu 18.04 LTS Filebeat module: Apache Filebeat Output: Elastichost:9200 Problem description: Our Apache error log contains PHP Stacktraces that spans many lines. Question 1: Is it possible to merge stacktraces with multiline settings directly in the apache.yml module? According to documentation [Manage multiline messages](https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html) these settings goes into filebeat.yml and not the specific module (apache). I've tried with different multiline settings directly in the apache.yml and restarted the filebeat services - It starts up fine without any complaints, but each stacktrace line is still separated. Follow up Question 2: I'm unsure that i got the correct regexp line for multiline.pattern, If someone could help me out it would be greatly appreciated. 🥰 Example for Apache error log: > Blockquote > [Wed Sep 11 10:45:36.633201 2019] [php7:notice] [pid 13832] [client 192.168.60.13:41228] PHP Stack trace:, referer: [http://TheWebSite.utv03-18.CMP.SRV/wp-cron.php?doing\_wp\_cron=1559551511.0737988948822021484375](http://TheWebSite.utv03-18.CMP.SRV/wp-cron.php?doing_wp_cron=1559551511.0737988948822021484375) > [Wed Sep 11 10:45:36.633252 2019] [php7:notice] [pid 13832] [client 192.168.60.13:41228] PHP 1. {main}() /var/www/Website/webroot/TheWebSite/wp-cron.php:0, referer: [http://TheWebSite.utv03-18.CMP.SRV/wp-cron.php?doing\_wp\_cron=1559551511.0737988948822021484375](http://TheWebSite.utv03-18.CMP.SRV/wp-cron.php?doing_wp_cron=1559551511.0737988948822021484375) > [Wed Sep 11 10:45:36.633274 2019] [php7:notice] [pid 13832] [client 192.168.60.13:41228] PHP 2. do\_action\_ref\_array() /var/www/Website/webroot/TheWebSite/wp-cron.php:133, referer: [http://TheWebSite.utv03-18.CMP.SRV/wp-cron.php?doing\_wp\_cron=1559551511.0737988948822021484375](http://TheWebSite.utv03-18.CMP.SRV/wp-cron.php?doing_wp_cron=1559551511.0737988948822021484375) > [Wed Sep 11 10:45:36.633294 2019] [php7:notice] [pid 13832] [client 192.168.60.13:41228] PHP 3. WP\_Hook-\>do\_action() /var/www/Website/webroot/TheWebSite/wp-includes/plugin.php:531, referer: [http://TheWebSite.utv03-18.CMP.SRV/wp-cron.php?doing\_wp\_cron=1559551511.0737988948822021484375](http://TheWebSite.utv03-18.CMP.SRV/wp-cron.php?doing_wp_cron=1559551511.0737988948822021484375) > [Wed Sep 11 10:45:36.633314 2019] [php7:notice] [pid 13832] [client 192.168.60.13:41228] PHP 4. WP\_Hook-\>apply\_filters() /var/www/Website/webroot/TheWebSite/wp-includes/class-wp-hook.php:310, referer: [http://TheWebSite.utv03-18.CMP.SRV/wp-cron.php?doing\_wp\_cron=1559551511.0737988948822021484375](http://TheWebSite.utv03-18.CMP.SRV/wp-cron.php?doing_wp_cron=1559551511.0737988948822021484375) > [Wed Sep 11 10:45:36.633331 2019] [php7:notice] [pid 13832] [client 192.168.60.13:41228] PHP 5. wp\_version\_check() /var/www/Website/webroot/TheWebSite/wp-includes/class-wp-hook.php:286, referer: [http://TheWebSite.utv03-18.CMP.SRV/wp-cron.php?doing\_wp\_cron=1559551511.0737988948822021484375](http://TheWebSite.utv03-18.CMP.SRV/wp-cron.php?doing_wp_cron=1559551511.0737988948822021484375) > [Wed Sep 11 10:45:36.633348 2019] [php7:notice] [pid 13832] [client 192.168.60.13:41228] PHP 6. do\_action() /var/www/Website/webroot/TheWebSite/wp-includes/update.php:240, referer: [http://TheWebSite.utv03-18.CMP.SRV/wp-cron.php?doing\_wp\_cron=1559551511.0737988948822021484375](http://TheWebSite.utv03-18.CMP.SRV/wp-cron.php?doing_wp_cron=1559551511.0737988948822021484375) > [Wed Sep 11 10:45:36.633367 2019] [php7:notice] [pid 13832] [client 192.168.60.13:41228] PHP 7. WP\_Hook-\>do\_action() /var/www/Website/webroot/TheWebSite/wp-includes/plugin.php:465, referer: [http://TheWebSite.utv03-18.CMP.SRV/wp-cron.php?doing\_wp\_cron=1559551511.0737988948822021484375](http://TheWebSite.utv03-18.CMP.SRV/wp-cron.php?doing_wp_cron=1559551511.0737988948822021484375) > [Wed Sep 11 10:45:36.633385 2019] [php7:notice] [pid 13832] [client 192.168.60.13:41228] PHP 8. WP\_Hook-\>apply\_filters() /var/www/Website/webroot/TheWebSite/wp-includes/class-wp-hook.php:310, referer: [http://TheWebSite.utv03-18.CMP.SRV/wp-cron.php?doing\_wp\_cron=1559551511.0737988948822021484375](http://TheWebSite.utv03-18.CMP.SRV/wp-cron.php?doing_wp_cron=1559551511.0737988948822021484375) > [Wed Sep 11 10:45:36.633402 2019] [php7:notice] [pid 13832] [client 192.168.60.13:41228] PHP 9. wp\_maybe\_auto\_update() /var/www/Website/webroot/TheWebSite/wp-includes/class-wp-hook.php:286, referer: [http://TheWebSite.utv03-18.CMP.SRV/wp-cron.php?doing\_wp\_cron=1559551511.0737988948822021484375](http://TheWebSite.utv03-18.CMP.SRV/wp-cron.php?doing_wp_cron=1559551511.0737988948822021484375) > [Wed Sep 11 10:45:36.633441 2019] [php7:notice] [pid 13832] [client 192.168.60.13:41228] PHP 10. WP\_Automatic\_Updater-\>run() /var/www/Website/webroot/TheWebSite/wp-includes/update.php:602, referer: [http://TheWebSite.utv03-18.CMP.SRV/wp-cron.php?doing\_wp\_cron=1559551511.0737988948822021484375](http://TheWebSite.utv03-18.CMP.SRV/wp-cron.php?doing_wp_cron=1559551511.0737988948822021484375) > [Wed Sep 11 10:45:36.633462 2019] [php7:notice] [pid 13832] [client 192.168.60.13:41228] PHP 11. WP\_Automatic\_Updater-\>after\_core\_update() /var/www/Website/webroot/TheWebSite/wp-admin/includes/class-wp-automatic-updater.php:498, referer: [http://TheWebSite.utv03-18.CMP.SRV/wp-cron.php?doing\_wp\_cron=1559551511.0737988948822021484375](http://TheWebSite.utv03-18.CMP.SRV/wp-cron.php?doing_wp_cron=1559551511.0737988948822021484375) > [Wed Sep 11 10:45:36.633480 2019] [php7:notice] [pid 13832] [client 192.168.60.13:41228] PHP 12. WP\_Automatic\_Updater-\>send\_email() /var/www/Website/webroot/TheWebSite/wp-admin/includes/class-wp-automatic-updater.php:529, referer: [http://TheWebSite.utv03-18.CMP.SRV/wp-cron.php?doing\_wp\_cron=1559551511.0737988948822021484375](http://TheWebSite.utv03-18.CMP.SRV/wp-cron.php?doing_wp_cron=1559551511.0737988948822021484375) > [Wed Sep 11 10:45:36.622885 2019] [php7:notice] [pid 13832] [client 192.168.60.13:41228] PHP Warning: stream\_socket\_enable\_crypto(): Peer certificate CN=`dev04.CMP.SRV' did not match expected CN=`localhost' in /var/www/Website/webroot/TheWebSite/wp-includes/class-smtp.php on line 368, referer: [http://TheWebSite.utv03-18.CMP.SRV/wp-cron.php?doing\_wp\_cron=1559551511.0737988948822021484375](http://TheWebSite.utv03-18.CMP.SRV/wp-cron.php?doing_wp_cron=1559551511.0737988948822021484375) > [Wed Sep 11 10:45:36.622885 2019] [php7:notice] [pid 13832] [client 192.168.60.13:41228] PHP Warning: stream\_socket\_enable\_crypto(): Peer certificate CN=`dev04.CMP.SRV' did not match expected CN=`localhost' in /var/www/Website/webroot/TheWebSite/wp-includes/class-smtp.php on line 368, referer: [http://TheWebSite.utv03-18.CMP.SRV/wp-cron.php?doing\_wp\_cron=1559551511.0737988948822021484375](http://TheWebSite.utv03-18.CMP.SRV/wp-cron.php?doing_wp_cron=1559551511.0737988948822021484375)[Wed Sep 11 10:45:36.633201 2019] [php7:notice] [pid 13832] [client 192.168.60.13:41228] PHP Stack trace:, referer: [http://TheWebSite.utv03-18.CMP.SRV/wp-cron.php?doing\_wp\_cron=1559551511.0737988948822021484375](http://TheWebSite.utv03-18.CMP.SRV/wp-cron.php?doing_wp_cron=1559551511.0737988948822021484375) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 10, 2019, 9:46am UTC](https://discuss.elastic.co/t/beats-apache-module-multiline-to-join-php-stack-trace/199190/2 "2019-10-10T09:46:54Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.