# Filebeat 1.1.0: Multiline Patterns **URL:** https://discuss.elastic.co/t/filebeat-1-1-0-multiline-patterns/46947 **Category:** Beats **Tags:** filebeat **Created:** [April 11, 2016, 6:57am UTC](https://discuss.elastic.co/t/filebeat-1-1-0-multiline-patterns/46947 "2016-04-11T06:57:24Z") **Posts on this page:** 13 **Page:** 1
### Author: ![dawiro](https://avatars.discourse-cdn.com/v4/letter/d/71e660/32.png) [@dawiro](https://discuss.elastic.co/u/dawiro) #### Post date: [April 11, 2016, 6:57am UTC](https://discuss.elastic.co/t/filebeat-1-1-0-multiline-patterns/46947/1 "2016-04-11T06:57:25Z")
Hi, Does filebeat have any definitions for common patterns that need to be matched in log lines? Could the logstash grok patterns be reused? Is there a way I could make a set of pattern definitions available to filebeat? Regards, David ---
### Author: ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin) #### Post date: [April 11, 2016, 7:16am UTC](https://discuss.elastic.co/t/filebeat-1-1-0-multiline-patterns/46947/2 "2016-04-11T07:16:55Z")
Grok support in beats is something that pops up quite frequently. See [https://discuss.elastic.co/search?q=grok%20category%3A42](https://discuss.elastic.co/search?q=grok%20category%3A42) I assume the problem in your case is that the regexp get too complex? Currently the best way would be to extend the docs of filebeat with these patterns so others can just copy /paste it. A good place would be probably here: [https://github.com/elastic/beats/blob/master/libbeat/docs/regexp.asciidoc](https://github.com/elastic/beats/blob/master/libbeat/docs/regexp.asciidoc) ---
### Author: ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens) #### Post date: [April 11, 2016, 11:34am UTC](https://discuss.elastic.co/t/filebeat-1-1-0-multiline-patterns/46947/3 "2016-04-11T11:34:55Z")
To be honest, I haven't really encountered a good use-case one needs the complicated patterns (even if abstracted away by grok). Trick is to not look at content as is (no need to write a 'full' regular parser), but look for patterns/shape of content. Disadvantage of 'overcomplicated' patterns (sure they are not, but for use case of merging lines often is), is increased processing time by regex engine. We're watching the forum and trying to collect use cases for documentation purposes. Any use-case you want to share? ---
### Author: ![dawiro](https://avatars.discourse-cdn.com/v4/letter/d/71e660/32.png) [@dawiro](https://discuss.elastic.co/u/dawiro) #### Post date: [April 12, 2016, 7:36am UTC](https://discuss.elastic.co/t/filebeat-1-1-0-multiline-patterns/46947/4 "2016-04-12T07:36:46Z")
Well, I'm looking at cassandra style logs which have a format like this: ```auto [] ``` ---
### Author: ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens) #### Post date: [April 12, 2016, 4:24pm UTC](https://discuss.elastic.co/t/filebeat-1-1-0-multiline-patterns/46947/5 "2016-04-12T16:24:53Z")
well, that's only half of the story, how do multline logs look like exactly? Assuming multiline is just stack traces starting with spaces a pattern like `'^[[:space:]]+` might do the trick. ---
### Author: ![dawiro](https://avatars.discourse-cdn.com/v4/letter/d/71e660/32.png) [@dawiro](https://discuss.elastic.co/u/dawiro) #### Post date: [April 13, 2016, 3:03pm UTC](https://discuss.elastic.co/t/filebeat-1-1-0-multiline-patterns/46947/6 "2016-04-13T15:03:34Z")
When I uncomment this bit of the config no log lines get processed at all. ---
### Author: ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens) #### Post date: [April 13, 2016, 7:31pm UTC](https://discuss.elastic.co/t/filebeat-1-1-0-multiline-patterns/46947/7 "2016-04-13T19:31:35Z")
> [@dawiro](#): > > When I uncomment this bit of the config no log lines get processed at all. Sorry, I don't understand what you're talking about. ---
### Author: ![dawiro](https://avatars.discourse-cdn.com/v4/letter/d/71e660/32.png) [@dawiro](https://discuss.elastic.co/u/dawiro) #### Post date: [April 14, 2016, 7:22am UTC](https://discuss.elastic.co/t/filebeat-1-1-0-multiline-patterns/46947/8 "2016-04-14T07:22:35Z")
The multiline config is commented out. It is commented out because when it is active all processing stops because of the error reported earlier. ---
### Author: ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens) #### Post date: [April 14, 2016, 12:11pm UTC](https://discuss.elastic.co/t/filebeat-1-1-0-multiline-patterns/46947/9 "2016-04-14T12:11:45Z")
config file is yaml and pretty sensitive to indentation and so on. Can you please share your filebeat.yml file so I can have a look? If it continues to fail due to error reported earlier, does it mean you didn't change the regex to `'^[[:space:]]'`? ---
### Author: ![dawiro](https://avatars.discourse-cdn.com/v4/letter/d/71e660/32.png) [@dawiro](https://discuss.elastic.co/u/dawiro) #### Post date: [April 15, 2016, 1:35pm UTC](https://discuss.elastic.co/t/filebeat-1-1-0-multiline-patterns/46947/10 "2016-04-15T13:35:54Z")
Ok, here's my prospector config: ```auto filebeat: prospectors: - document_type: cassandra input_type: log paths: - /var/log/cassandra/*.log - /var/log/cassandra/audit/*.log scan_frequency: 5s ignore_older: 168h multiline: pattern: '^\s' match: after ``` ---
### Author: ![dawiro](https://avatars.discourse-cdn.com/v4/letter/d/71e660/32.png) [@dawiro](https://discuss.elastic.co/u/dawiro) #### Post date: [April 15, 2016, 1:36pm UTC](https://discuss.elastic.co/t/filebeat-1-1-0-multiline-patterns/46947/11 "2016-04-15T13:36:32Z")
Seems like the indentation has been lost... ---
### Author: ![dawiro](https://avatars.discourse-cdn.com/v4/letter/d/71e660/32.png) [@dawiro](https://discuss.elastic.co/u/dawiro) #### Post date: [April 15, 2016, 2:00pm UTC](https://discuss.elastic.co/t/filebeat-1-1-0-multiline-patterns/46947/12 "2016-04-15T14:00:18Z")
Changing the config to use the modified regex format you described seems to work...thank you:) ---
### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system) #### Post date: [July 5, 2017, 9:53pm UTC](https://discuss.elastic.co/t/filebeat-1-1-0-multiline-patterns/46947/13 "2017-07-05T21:53:12Z")