# Dissect first then multiline in filebeat

**URL:** <https://discuss.elastic.co/t/dissect-first-then-multiline-in-filebeat/369748>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [October 29, 2024, 3:13pm UTC](https://discuss.elastic.co/t/dissect-first-then-multiline-in-filebeat/369748 "2024-10-29T15:13:32Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![justkind](https://avatars.discourse-cdn.com/v4/letter/j/919ad9/32.png) [@justkind](https://discuss.elastic.co/u/justkind)\
**Post date:** [October 29, 2024, 3:13pm UTC](https://discuss.elastic.co/t/dissect-first-then-multiline-in-filebeat/369748/1 "2024-10-29T15:13:32Z")

</div>

Hi everyone,

Any help would be greatly appreciated.

We recently upgraded our kubernetes cluster and all logs are now coming in with the new kubernetes CRI log format, that includes a timestamp and the output stream type prepending every log event example:

```auto
2023-10-06T00:17:09.669794202Z stdout F Exception in thread "main" java.lang.NullPointerException
2023-10-06T00:17:09.669794202Z stdout F at com.example.myproject.Book.getTitle(Book.java:16)
2023-10-06T00:17:09.669794202Z stdout F at com.example.myproject.Author.getBookTitles(Author.java:25)
2023-10-06T00:17:10.113242941Z stdout F at com.example.myproject.Bootstrap.main(Bootstrap.java:14)

```

I am able to sucessfully remove the new CRI logs by using the dissect filter in Filebeat on my filestream input, to extract the log messages before sending it to Logstash.

However, I'm running into issues with multiline log events. From my testing, I haven't been able to first extract the log messages using dissect, then apply the multiline parser after to aggregate log events. Multiline never seems to go through as I am assuming it is being applied to log events before it's been dissected.

Does anyone know if running multiline after dissect is possible? Thanks in advance for your time and any help

---

<div class="post-metadata">

**Author:** ![justkind](https://avatars.discourse-cdn.com/v4/letter/j/919ad9/32.png) [@justkind](https://discuss.elastic.co/u/justkind)\
**Post date:** [December 11, 2024, 11:06pm UTC](https://discuss.elastic.co/t/dissect-first-then-multiline-in-filebeat/369748/2 "2024-12-11T23:06:24Z")

</div>

Any help would be greatly appreciated 🙏

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [December 11, 2024, 11:27pm UTC](https://discuss.elastic.co/t/dissect-first-then-multiline-in-filebeat/369748/3 "2024-12-11T23:27:49Z")

</div>

> [@justkind](#):
>
> Does anyone know if running multiline after dissect is possible?

I don't think so, the `parsers` are executed before the `processors`.

But, wouldn't using this configuration works?

```auto
parsers:
  - container:
     # Source of container events. Available options: all, stdin, stderr.
     stream: all
     # Format of the container events. Available options: auto, cri, docker, json-file
     format: cri

```

I do not use k8s or filebeat, so I can not test it, but it's worth a try.

---

<div class="post-metadata">

**Author:** ![justkind](https://avatars.discourse-cdn.com/v4/letter/j/919ad9/32.png) [@justkind](https://discuss.elastic.co/u/justkind)\
**Post date:** [January 8, 2025, 9:50pm UTC](https://discuss.elastic.co/t/dissect-first-then-multiline-in-filebeat/369748/4 "2025-01-08T21:50:01Z")

</div>

Thanks so much Leandro! Using the container parser works exactly how I'd like it to! I am now getting the cri logging format and multiline.

Really appreciate your help!