# Error in Multiline parser of timestamp

**URL:** <https://discuss.elastic.co/t/error-in-multiline-parser-of-timestamp/333598>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 16, 2023, 7:39pm UTC](https://discuss.elastic.co/t/error-in-multiline-parser-of-timestamp/333598 "2023-05-16T19:39:48Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![stefws](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stefws/32/6442_2.png) [@stefws](https://discuss.elastic.co/u/stefws)\
**Post date:** [May 16, 2023, 7:39pm UTC](https://discuss.elastic.co/t/error-in-multiline-parser-of-timestamp/333598/1 "2023-05-16T19:39:48Z")

</div>

Having an issue with a multiline parser in one of own filebeat instance type of Redhat AMQ log which puzzles me, so any hints are appreciated, TIA.

See all events dropped in filebeat log due to error like this:

```auto
{\"type\":\"mapper_parsing_exception\",\"reason\":\"failed to parse field [@timestamp] of type [date] in document with id 'mL4KJogBExph4ByXEjTj'. Preview of field's value: '2023-05-16 21:29:19,658'\",\"caused_by\":{\"type\":\"illegal_argument_exception\",\"reason\":\"failed to parse date field [2023-05-16 21:29:19,658] with format [strict_date_optional_time||epoch_millis]\",\"caused_by\":{\"type\":\"date_time_parse_exception\",\"reason\":\"date_time_parse_exception: Failed to parse with all enclosed parsers\"}}}, dropping event!","service.name":"filebeat","ecs.version":"1.6.0"}

```

Our parser like like this:

```auto
  parsers:
    - multiline:
        type: pattern
        # Example: 2022-07-06 10:29:32 ...
        # Example: 2022-07-06 10:29:28,022 ...
        # Example: 2023-05-15 15:20:18,676 INFO
        pattern: '^[[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]]{2}:[[:digit:]]{2}:[[:digit:]]{2}'
        negate: true
        match: after
        max_lines: 5000

```

Similar parser is work fine for other logs in other instances.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 13, 2023, 9:40pm UTC](https://discuss.elastic.co/t/error-in-multiline-parser-of-timestamp/333598/2 "2023-06-13T21:40:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.