# Error in Multiline Parsing

**URL:** <https://discuss.elastic.co/t/error-in-multiline-parsing/81211>\
**Category:** Beats\
**Created:** [April 4, 2017, 7:31pm UTC](https://discuss.elastic.co/t/error-in-multiline-parsing/81211 "2017-04-04T19:31:47Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![howardkr](https://avatars.discourse-cdn.com/v4/letter/h/a587f6/32.png) [@howardkr](https://discuss.elastic.co/u/howardkr)\
**Post date:** [April 4, 2017, 7:31pm UTC](https://discuss.elastic.co/t/error-in-multiline-parsing/81211/1 "2017-04-04T19:31:47Z")

</div>

All,

I'm having a slight issue having multiline apply to my stack trace logs.

I have tried with the pattern of:

```auto
    multiline.pattern: '^[[:space:]]'
    multiline.negate: false
    multiline.match: after

```

and:

```auto
   multiline.pattern: '^\['
   multiline.negate: true
   multiline.match: after

```

Both of these options were on Elastic's documentation around applying multiline to stack trace messages.

I am trying to ship from beats to logstash.

My beats config looks like:

```auto
 filebeat:
        
          prospectors:
        
          - input_type: log
          
            paths:
        
               - /var/log/tomcat8/CWeb.log
        
            multiline.pattern: '^\['
            multiline.negate: true
            multiline.match: after
        
            scan_frequency: 60s
        
            ignore_older: 24h
            
            document_type: cweb
            
          - input_type: log
          
            paths:
        
               - /var/log/tomcat8/*.log
        
            exclude_files: ['CWeb.log']
            
            scan_frequency: 60s
        
            ignore_older: 24h
            
            document_type: tomcat
            
          - input_type: log
          
            paths:
          
               - /var/log/tomcat8/*.txt
        
            scan_frequency: 60s
        
            ignore_older: 24h
        
            document_type: access
            
          - input_type: log
          
            paths:
            
               - /var/log/tomcat8/catalina.out
        
            multiline.pattern: '\%{MONTHDAY}-%{MONTH}-%{YEAR} %{TIME}'
            multiline.negate: true
            multiline.match: after
        
            scan_frequency: 60s
        
            ignore_older: 24h
       
          - input_type: log

            paths:

               - /var/log/httpd/elasticbeanstalk-access_log

            exclude_lines: ['^.*ELB-HealthChecker.*$']

            scan_frequency: 60s

            ignore_older: 24h

            document_type: apache

        output:
        
            logstash:
        
               hosts: ["DNS:5044"] 
        
               tls:
        
                 certificate_authorities: ["/etc/pki/tls/certs/ServerCertificate.crt"]
                 certificate: "/etc/pki/tls/certs/anotherhost.crt"
                 certificate_key: "/etc/pki/tls/certs/anotherhost.key"

```

my logstash config looks like:

```auto
input {
    beats {
        port => 5044
        ssl => true
        ssl_verify_mode => "force_peer"
        ssl_certificate_authorities => ["/config/certs/ServerCertificate.crt"]
        ssl_certificate => "/config/certs/Client-Signed-Certificate.crt"
        ssl_key => "/config/certs/ClientPrivateKey.key"
    }
}

output {
    elasticsearch {
        hosts => ["elasticsearch:9200"]
    }
}

```

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [April 4, 2017, 10:44pm UTC](https://discuss.elastic.co/t/error-in-multiline-parsing/81211/3 "2017-04-04T22:44:24Z")

</div>

What version of Filebeat are you using (`filebeat -version`)?

And what is the specific problem that you are having?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 25, 2017, 7:31pm UTC](https://discuss.elastic.co/t/error-in-multiline-parsing/81211/4 "2017-04-25T19:31:59Z")

</div>

This topic was automatically closed after 21 days. New replies are no longer allowed.