# Dissect combined with multiline pattern gives errors

**URL:** <https://discuss.elastic.co/t/dissect-combined-with-multiline-pattern-gives-errors/239728>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [July 3, 2020, 4:43am UTC](https://discuss.elastic.co/t/dissect-combined-with-multiline-pattern-gives-errors/239728 "2020-07-03T04:43:56Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![shaunak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shaunak/32/6643_2.png) [@shaunak](https://discuss.elastic.co/u/shaunak)\
**Post date:** [July 6, 2020, 3:18pm UTC](https://discuss.elastic.co/t/dissect-combined-with-multiline-pattern-gives-errors/239728/2 "2020-07-06T15:18:16Z")

</div>

Hi @kainazzzo, welcome to the Elastic community forums!

Hmm, I just tested your configuration and sample input with Filebeat built off the `master` branch and it works as expected.

My filebeat configuration file, `filebeat.test.yml`:

```auto
filebeat.inputs:
  - type: stdin
    processors:
      - dissect:
          tokenizer: "%{logtime} %{+logtime} [%{src}] %{loglevel} %{classname} - %{msg}"
          field: message
          target_prefix: ""
    multiline:
      pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}'
      negate: true
      match: after
      
output.console:
  enabled: true

```

Running Filebeat:

```auto
$ /filebeat -c filebeat.test.yml
2020-05-12 15:31:52,853 [main] INFO com.organization.className - Rest of message
2020-05-12 15:34:52,853 [main] INFO com.organization.className - Rest of message 2
2020-05-12 15:35:52,853 [main] INFO com.organization.className - Rest of message 3
2020-05-12 15:36:52,853 [main] INFO com.organization.className - Rest of message 4
but sometimes it goes on for multiple lines
like this
  sometimes there are spaces and then stack traces
  I did not mean to rhyme
2020-05-12 15:39:52,853 [main] INFO com.organization.className - Rest of message
{"@timestamp":"2020-07-06T15:15:25.940Z","@metadata":{"beat":"filebeat","type":"_doc","version":"8.0.0"},"logtime":"2020-05-12 15:31:52,853","agent":{"type":"filebeat","version":"8.0.0","ephemeral_id":"3c793acb-c2e4-439b-a715-c5c73187830f","id":"e3c91a8c-d8e3-4ac2-a32b-4acbd7caba77","name":"Shaunaks-MacBook-Pro-Work.local"},"host":{"name":"Shaunaks-MacBook-Pro-Work.local"},"input":{"type":"stdin"},"classname":"com.organization.className","loglevel":"INFO","msg":"Rest of message","src":"main","ecs":{"version":"1.5.0"},"log":{"file":{"path":""},"offset":0},"message":"2020-05-12 15:31:52,853 [main] INFO com.organization.className - Rest of message"}
{"@timestamp":"2020-07-06T15:15:25.940Z","@metadata":{"beat":"filebeat","type":"_doc","version":"8.0.0"},"input":{"type":"stdin"},"src":"main","loglevel":"INFO","agent":{"ephemeral_id":"3c793acb-c2e4-439b-a715-c5c73187830f","id":"e3c91a8c-d8e3-4ac2-a32b-4acbd7caba77","name":"Shaunaks-MacBook-Pro-Work.local","type":"filebeat","version":"8.0.0"},"ecs":{"version":"1.5.0"},"host":{"name":"Shaunaks-MacBook-Pro-Work.local"},"log":{"offset":0,"file":{"path":""}},"message":"2020-05-12 15:34:52,853 [main] INFO com.organization.className - Rest of message 2","logtime":"2020-05-12 15:34:52,853","classname":"com.organization.className","msg":"Rest of message 2"}
{"@timestamp":"2020-07-06T15:15:25.940Z","@metadata":{"beat":"filebeat","type":"_doc","version":"8.0.0"},"ecs":{"version":"1.5.0"},"host":{"name":"Shaunaks-MacBook-Pro-Work.local"},"log":{"offset":0,"file":{"path":""}},"classname":"com.organization.className","logtime":"2020-05-12 15:35:52,853","loglevel":"INFO","msg":"Rest of message 3","agent":{"type":"filebeat","version":"8.0.0","ephemeral_id":"3c793acb-c2e4-439b-a715-c5c73187830f","id":"e3c91a8c-d8e3-4ac2-a32b-4acbd7caba77","name":"Shaunaks-MacBook-Pro-Work.local"},"message":"2020-05-12 15:35:52,853 [main] INFO com.organization.className - Rest of message 3","input":{"type":"stdin"},"src":"main"}
{"@timestamp":"2020-07-06T15:15:25.940Z","@metadata":{"beat":"filebeat","type":"_doc","version":"8.0.0"},"classname":"com.organization.className","msg":"Rest of message 4\nbut sometimes it goes on for multiple lines\nlike this\n sometimes there are spaces and then stack traces\n I did not mean to rhyme","logtime":"2020-05-12 15:36:52,853","loglevel":"INFO","ecs":{"version":"1.5.0"},"log":{"flags":["multiline"],"offset":0,"file":{"path":""}},"input":{"type":"stdin"},"src":"main","host":{"name":"Shaunaks-MacBook-Pro-Work.local"},"agent":{"type":"filebeat","version":"8.0.0","ephemeral_id":"3c793acb-c2e4-439b-a715-c5c73187830f","id":"e3c91a8c-d8e3-4ac2-a32b-4acbd7caba77","name":"Shaunaks-MacBook-Pro-Work.local"},"message":"2020-05-12 15:36:52,853 [main] INFO com.organization.className - Rest of message 4\nbut sometimes it goes on for multiple lines\nlike this\n sometimes there are spaces and then stack traces\n I did not mean to rhyme"}
{"@timestamp":"2020-07-06T15:15:26.614Z","@metadata":{"beat":"filebeat","type":"_doc","version":"8.0.0"},"input":{"type":"stdin"},"ecs":{"version":"1.5.0"},"agent":{"type":"filebeat","version":"8.0.0","ephemeral_id":"3c793acb-c2e4-439b-a715-c5c73187830f","id":"e3c91a8c-d8e3-4ac2-a32b-4acbd7caba77","name":"Shaunaks-MacBook-Pro-Work.local"},"message":"2020-05-12 15:39:52,853 [main] INFO com.organization.className - Rest of message","classname":"com.organization.className","msg":"Rest of message","logtime":"2020-05-12 15:39:52,853","src":"main","loglevel":"INFO","host":{"name":"Shaunaks-MacBook-Pro-Work.local"},"log":{"offset":0,"file":{"path":""}}}

```

What version of Filebeat are you using? Once you tell me that I can try to reproduce the issue with that version.

Thanks!

Shaunak

---

_[View the full topic](https://discuss.elastic.co/t/dissect-combined-with-multiline-pattern-gives-errors/239728)._