# ElasticSearch removing message after new line character

**URL:** <https://discuss.elastic.co/t/elasticsearch-removing-message-after-new-line-character/82321>\
**Category:** Elasticsearch\
**Created:** [April 13, 2017, 3:16pm UTC](https://discuss.elastic.co/t/elasticsearch-removing-message-after-new-line-character/82321 "2017-04-13T15:16:32Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![epollum](https://avatars.discourse-cdn.com/v4/letter/e/97f17d/32.png) [@epollum](https://discuss.elastic.co/u/epollum)\
**Post date:** [April 13, 2017, 3:16pm UTC](https://discuss.elastic.co/t/elasticsearch-removing-message-after-new-line-character/82321/1 "2017-04-13T15:16:32Z")

</div>

I am using Elasticsearch 5.3 with Filebeat to collect java system logs. I ship them directly to elasticsearch's ingest pipeline. I have filebeat set up to merge stacktraces into a single event, which I have verified is working correctly, however when I ship it to elastic, the message gets cut off after the first new line character. How can I resolve this?

Filebeat multiline processor:  
multiline.pattern: '^['  
multiline.negate: true  
multiline.match: after

ElasticSearch pipeline:  
"grok": {  
"field": "message",  
"patterns": [  
"""%{GREEDYDATA:message}"""  
]  
}

For example, Filebeat will send this message:  
[2017-04-12 19:02:44.990] [Emmas-MacBook-Pro.local] [main] ERROR o.s.boot.SpringApplication@reportFailure:839 - Application startup failed\norg.springframework.beans.factory.

And Elasticsearch will only save  
"[2017-04-12 19:02:44.990] [Emmas-MacBook-Pro.local] [main] ERROR o.s.boot.SpringApplication@reportFailure:839 - Application startup failed"  
In the message field

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 11, 2017, 3:20pm UTC](https://discuss.elastic.co/t/elasticsearch-removing-message-after-new-line-character/82321/2 "2017-05-11T15:20:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.