# Filebeat 9.2.1multiline pattern not grouping MariaDB slow query logs

**URL:** <https://discuss.elastic.co/t/filebeat-9-2-1multiline-pattern-not-grouping-mariadb-slow-query-logs/383643>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [November 25, 2025, 9:56am UTC](https://discuss.elastic.co/t/filebeat-9-2-1multiline-pattern-not-grouping-mariadb-slow-query-logs/383643 "2025-11-25T09:56:13Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Amanuel\_Genetu](https://avatars.discourse-cdn.com/v4/letter/a/e79b87/32.png) [@Amanuel\_Genetu](https://discuss.elastic.co/u/Amanuel_Genetu)\
**Post date:** [November 25, 2025, 9:56am UTC](https://discuss.elastic.co/t/filebeat-9-2-1multiline-pattern-not-grouping-mariadb-slow-query-logs/383643/1 "2025-11-25T09:56:13Z")

</div>

I am trying to collect MariaDB slow query logs with Filebeat and group each query as a single event. My logs look like this:

```auto
SET timestamp=1764062324;
SELECT TABLE_NAME
  FROM information_schema.TABLES
 WHERE TABLE_SCHEMA = 'HORIZONEU_archive'
   AND TABLE_NAME = 'KIT_ASSEMBLIES';
# User@Host: dba[dba] @ [10.71.180.40]
# Thread_id: 213322 Schema: admin QC_hit: No
...
SET timestamp=1764062324;
SELECT TRIM(ROUTINE_COMMENT) AS PROCEDURE_HASH
  FROM INFORMATION_SCHEMA.ROUTINES
  WHERE ROUTINE_SCHEMA = 'HORIZONEU_stage'
    AND ROUTINE_NAME = 'sp_LOAD_KIT_ASSEMBLIES_CDC';
# User@Host: dba[dba] @ [10.71.180.40]
...

```

I want each `SET timestamp=...` block (plus all lines until the next `SET timestamp=`) to be sent as a single event to Graylog.

```auto
filebeat.inputs:
- type: filestream
  enabled: true
  paths:
    - /var/log/mariadb/slow.log
  fields:
    type: mariadb-slow-log
    source_type: mariadb_slow
  multiline:
    pattern: '^SET timestamp='
    match: after
    negate: true

output.logstash:
  hosts: [""]

```

I also tried:

```auto
multiline:
  pattern: '^SET timestamp=|^# User@Host:'
  match: after
  negate: true

```

**What I observe:**

- Filebeat still sends each line as a separate event.

- Graylog receives one JSON per line instead of grouped blocks.

**Request:**

- Advice on correct multiline pattern for MariaDB slow query logs.

- Explanation why `pattern: '^SET timestamp='` or `'^SET timestamp=|^# User@Host:'` does not work.

---

<div class="post-metadata">

**Author:** ![Ljapunov](https://avatars.discourse-cdn.com/v4/letter/l/f4b2a3/32.png) [@Ljapunov](https://discuss.elastic.co/u/Ljapunov)\
**Post date:** [December 1, 2025, 6:02am UTC](https://discuss.elastic.co/t/filebeat-9-2-1multiline-pattern-not-grouping-mariadb-slow-query-logs/383643/2 "2025-12-01T06:02:16Z")

</div>

Hi Amanuel\_Genetu,

with “type: filestream” you need to define the multiline inside of a block called “parsers”

```auto
  parsers:
    - multiline:
        pattern: '^SET timestamp='
        negate: true
        match: after

```

Your definition will work for the (older) filebeat-input-type “log”.

---

<div class="post-metadata">

**Author:** ![Amanuel\_Genetu](https://avatars.discourse-cdn.com/v4/letter/a/e79b87/32.png) [@Amanuel\_Genetu](https://discuss.elastic.co/u/Amanuel_Genetu)\
**Post date:** [December 3, 2025, 10:36am UTC](https://discuss.elastic.co/t/filebeat-9-2-1multiline-pattern-not-grouping-mariadb-slow-query-logs/383643/3 "2025-12-03T10:36:40Z")

</div>

**Hi [Ljapunov](https://discuss.elastic.co/u/ljapunov),** Thank you for the explanation. Moving multiline under parsers fixed the issue!