# Filebeat 5.3.0 regex parsing regression
**URL:** https://discuss.elastic.co/t/filebeat-5-3-0-regex-parsing-regression/80887
**Category:** Beats
**Tags:** filebeat
**Created:** [April 1, 2017, 2:52am UTC](https://discuss.elastic.co/t/filebeat-5-3-0-regex-parsing-regression/80887 "2017-04-01T02:52:46Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Karl\_Grose](https://discuss.elastic.co/u/Karl_Grose)
#### Post date: [April 1, 2017, 2:52am UTC](https://discuss.elastic.co/t/filebeat-5-3-0-regex-parsing-regression/80887/1 "2017-04-01T02:52:46Z")
The following regex pattern:
multiline.pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2} '
worked for 5.2.2 but causes a panic with 5.3.0 [1]. Using this instead:
multiline.pattern: '^[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9] '
allows filebeat to run again.
# ======= [1] Mar 31 01:08:21 auth-d1 filebeat: panic: runtime error: index out of range Mar 31 01:08:21 auth-d1 filebeat: goroutine 1 [running]: Mar 31 01:08:21 auth-d1 filebeat: panic(0x9344c0, 0xc42000e060) Mar 31 01:08:21 auth-d1 filebeat: /usr/local/go/src/runtime/panic.go:500 +0x1a1 Mar 31 01:08:21 auth-d1 filebeat: [github.com/elastic/beats/libbeat/common/match.isPrefixNumDate](http://github.com/elastic/beats/libbeat/common/match.isPrefixNumDate)(0xc4202fa700, 0x7f49d5d4b000) Mar 31 01:08:21 auth-d1 filebeat: /go/src/github.com/elastic/beats/libbeat/common/match/cmp.go:107 +0x108 Mar 31 01:08:21 auth-d1 filebeat: [github.com/elastic/beats/libbeat/common/match.compile](http://github.com/elastic/beats/libbeat/common/match.compile)(0xc4202fa700, 0xc4202fa700, 0xc4202700d4, xc4202fa4d0, 0x0) Mar 31 01:08:21 auth-d1 filebeat: /go/src/github.com/elastic/beats/libbeat/common/match/compile.go:43 +0x8ec Mar 31 01:08:21 auth-d1 filebeat: [github.com/elastic/beats/libbeat/common/match.Compile](http://github.com/elastic/beats/libbeat/common/match.Compile)(0xc4201940a0, 0x1c, 0x93caa0, 0x96d2e0, 0x6d201, 0x7f49d5cf7458) Mar 31 01:08:21 auth-d1 filebeat: /go/src/github.com/elastic/beats/libbeat/common/match/matcher.go:60 +0x79 Mar 31 01:08:21 auth-d1 filebeat: [github.com/elastic/beats/libbeat/common/match.(\*Matcher](http://github.com/elastic/beats/libbeat/common/match.(*Matcher)).Unpack(0xc42019f060, 0xc4201940a0, 0x1c 0x1c, 0x0) Mar 31 01:08:21 auth-d1 filebeat: /go/src/github.com/elastic/beats/libbeat/common/match/matcher.go:96 +0x39 Mar 31 01:08:21 auth-d1 filebeat: [github.com/elastic/beats/vendor/github.com/elastic/go-ucfg.unpackWith](http://github.com/elastic/beats/vendor/github.com/elastic/go-ucfg.unpackWith)(0xc42006ff00, 0x96d2e0, 0x42019f060, 0x16, 0xc85340, 0xc420011ec0, 0xc42018de01, 0x8c98eb) Mar 31 01:08:21 auth-d1 filebeat: /go/src/github.com/elastic/beats/vendor/github.com/elastic/go-ucfg/unpack.go:183 +0x6da Mar 31 01:08:21 auth-d1 filebeat: [github.com/elastic/beats/vendor/github.com/elastic/go-ucfg.reifyMergeValue](http://github.com/elastic/beats/vendor/github.com/elastic/go-ucfg.reifyMergeValue)(0xc42006ff00, 0x0, 0x, 0x0, 0x0, 0x971ae0, 0xc42019f060, 0x199, 0xc85340, 0xc420011ec0, ...) Mar 31 01:08:21 auth-d1 filebeat: /go/src/github.com/elastic/beats/vendor/github.com/elastic/go-ucfg/reify.go:377 +0x21a Mar 31 01:08:21 auth-d1 filebeat: [github.com/elastic/beats/vendor/github.com/elastic/go-ucfg.reifyGetField](http://github.com/elastic/beats/vendor/github.com/elastic/go-ucfg.reifyGetField)(0xc42018de00, 0xc42006f00, 0x0, 0x0, 0x0, 0x0, 0x8c98eb, 0x7, 0x971ae0, 0xc42019f060, ...) Mar 31 01:08:21 auth-d1 filebeat: /go/src/github.com/elastic/beats/vendor/github.com/elastic/go-ucfg/reify.go:279 +0x288 Mar 31 01:08:21 auth-d1 filebeat: [github.com/elastic/beats/vendor/github.com/elastic/go-ucfg.reifyStruct](http://github.com/elastic/beats/vendor/github.com/elastic/go-ucfg.reifyStruct)(0xc42006ff00, 0x991980, 0c42019f000, 0x199, 0xc42018de00, 0x0, 0xc42027d000) Mar 31 01:08:21 auth-d1 filebeat: /go/src/github.com/elastic/beats/vendor/github.com/elastic/go-ucfg/reify.go:242 +0xa00 Mar 31 01:08:21 auth-d1 filebeat: [github.com/elastic/beats/vendor/github.com/elastic/go-ucfg.reifyInto](http://github.com/elastic/beats/vendor/github.com/elastic/go-ucfg.reifyInto)(0xc42006ff00, 0x991980, 0xc2019f000, 0x199, 0xc42018de00, 0xc42027d208, 0x40f05e) Mar 31 01:08:21 auth-d1 filebeat: /go/src/github.com/elastic/beats/vendor/github.com/elastic/go-ucfg/reify.go:139 +0x49c Mar 31 01:08:21 auth-d1 systemd: filebeat2.service: main process exited, code=exited, status=2/INVALIDARGUMENT
---
### Author:  [@ruflin](https://discuss.elastic.co/u/ruflin)
#### Post date: [April 3, 2017, 7:50am UTC](https://discuss.elastic.co/t/filebeat-5-3-0-regex-parsing-regression/80887/2 "2017-04-03T07:50:55Z")
This is probably because of [https://github.com/elastic/beats/pull/3469](https://github.com/elastic/beats/pull/3469) @steffens Could you have a look at this?
---
### Author:  [@ruflin](https://discuss.elastic.co/u/ruflin)
#### Post date: [April 3, 2017, 7:52am UTC](https://discuss.elastic.co/t/filebeat-5-3-0-regex-parsing-regression/80887/3 "2017-04-03T07:52:28Z")
@Karl_Grose Could you open a bug report with this on Github?
---
### Author:  [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [April 3, 2017, 8:10am UTC](https://discuss.elastic.co/t/filebeat-5-3-0-regex-parsing-regression/80887/4 "2017-04-03T08:10:26Z")
Can confirm this being a regression. The suffix `' '` is making the pattern-compiler trip. Changing the pattern to `'^[0-9]{4}-[0-9]{2}-[0-9]{2}'` should work.
---
### Author:  [@Karl\_Grose](https://discuss.elastic.co/u/Karl_Grose)
#### Post date: [April 3, 2017, 9:27am UTC](https://discuss.elastic.co/t/filebeat-5-3-0-regex-parsing-regression/80887/5 "2017-04-03T09:27:55Z")
>
---
### Author:  [@ruflin](https://discuss.elastic.co/u/ruflin)
#### Post date: [April 3, 2017, 9:49am UTC](https://discuss.elastic.co/t/filebeat-5-3-0-regex-parsing-regression/80887/6 "2017-04-03T09:49:50Z")
thanks
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 1, 2017, 9:50am UTC](https://discuss.elastic.co/t/filebeat-5-3-0-regex-parsing-regression/80887/7 "2017-05-01T09:50:07Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.