# Elastic Serverless Forwarder not reading multiline messages from s3-sqs

**URL:** <https://discuss.elastic.co/t/elastic-serverless-forwarder-not-reading-multiline-messages-from-s3-sqs/367050>\
**Category:** Elastic Observability\
**Tags:** lambda\
**Created:** [September 24, 2024, 1:58pm UTC](https://discuss.elastic.co/t/elastic-serverless-forwarder-not-reading-multiline-messages-from-s3-sqs/367050 "2024-09-24T13:58:53Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![DougR](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dougr/32/48095_2.png) [@DougR](https://discuss.elastic.co/u/DougR)\
**Post date:** [September 24, 2024, 1:58pm UTC](https://discuss.elastic.co/t/elastic-serverless-forwarder-not-reading-multiline-messages-from-s3-sqs/367050/1 "2024-09-24T13:58:53Z")

</div>

I am having an issue ingesting logs from Elastic Serverless Forwarder (ESF) using `s3-sqs`. The specific account is still using ESF v1.9.0, but we're in the process of updating that, in case this is part of the issue.

We are using the following config to read from an `s3-sqs` input:

```yaml
---
inputs:
  - type: "s3-sqs"
    id: "arn:aws:sqs:us-east-1:000000000000:my-sqs-queue"
    multiline:
      match: "after"
      negate: true
      pattern: '^\['
      type: "pattern"
    outputs:
      - type: "elasticsearch"
        tags: ["myapp"]
        args:
          elasticsearch_url: "https://my-elastic-cloud.us-east-1.aws.elastic-cloud.com:443"
          api_key: "changeme"
          es_datastream_name: "logs-generic.log-default"
          batch_max_actions: 500
          batch_max_bytes: 10485760

```

The log is from a vendor application. It is **very** freeform, but the log lines we care about are in the following format:

```auto
[2024-09-24T03:00:00,375Z] Log Message 1
[2024-09-24T03:00:03,554Z] Log Message 2

This is part of log message 2, including the blank line above this line.
Most multiline messages start with a blank line.

Still another line in log message 2, including the blank line above.
[2024-09-24T03:00:05,449Z] Log Message 3
This is also part of log message 3. There is no blank line above this line.
[2024-09-24T03:00:07,375Z] ...

```

As you can see, there are blank lines in the log message. However, only the first line of the log message (starting with `^\[`) is getting picked up. Everything else is being dropped.

I assume this is something with the log pattern, as I haven't been able to find any open or closed issues regarding multiline in the ESF repo.

Help?

## Updates

### Update #1

The [multiline message documentation](https://www.elastic.co/guide/en/esf/current/aws-elastic-serverless-forwarder-configuration.html#aws-serverless-manage-multiline-messages) states that the Python regex library is used, and the example pattern shows the following:

```yaml
pattern: '^\\['

```

However, when we use this, we get an error stating:

```auto
[ERROR] ConfigFileException: unterminated character set

```

The only way to get rid of this error was to use a single backslash to escape the pattern. This may indicate that the documentation needs to be updated.

### Update #2

Testing the logs both in the [multiline message Go playground](https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html#_test_your_regexp_pattern_for_multiline) and in Python both yield the expected results for processing log messages.

---

<div class="post-metadata">

**Author:** ![DougR](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dougr/32/48095_2.png) [@DougR](https://discuss.elastic.co/u/DougR)\
**Post date:** [September 24, 2024, 2:37pm UTC](https://discuss.elastic.co/t/elastic-serverless-forwarder-not-reading-multiline-messages-from-s3-sqs/367050/2 "2024-09-24T14:37:08Z")

</div>

Removed #elastic-cloud

---

<div class="post-metadata">

**Author:** ![DougR](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dougr/32/48095_2.png) [@DougR](https://discuss.elastic.co/u/DougR)\
**Post date:** [September 24, 2024, 2:59pm UTC](https://discuss.elastic.co/t/elastic-serverless-forwarder-not-reading-multiline-messages-from-s3-sqs/367050/3 "2024-09-24T14:59:02Z")

</div>

Removed #elastic-cloud

---

<div class="post-metadata">

**Author:** ![DougR](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dougr/32/48095_2.png) [@DougR](https://discuss.elastic.co/u/DougR)\
**Post date:** [September 25, 2024, 1:19pm UTC](https://discuss.elastic.co/t/elastic-serverless-forwarder-not-reading-multiline-messages-from-s3-sqs/367050/4 "2024-09-25T13:19:37Z")

</div>

Removed #elastic-cloud