# Filebeat can't manage multiline message with office example

**URL:** <https://discuss.elastic.co/t/filebeat-cant-manage-multiline-message-with-office-example/359420>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 14, 2024, 3:11am UTC](https://discuss.elastic.co/t/filebeat-cant-manage-multiline-message-with-office-example/359420 "2024-05-14T03:11:57Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Fodesu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fodesu/32/134439_2.png) [@Fodesu](https://discuss.elastic.co/u/Fodesu)\
**Post date:** [May 14, 2024, 3:11am UTC](https://discuss.elastic.co/t/filebeat-cant-manage-multiline-message-with-office-example/359420/1 "2024-05-14T03:11:57Z")

</div>

I tried using this config ([multiline-examples](https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html#multiline-examples)), but logstash doesn't output anymore, if i remove parsers section， it can output  
filebeat.yml

```auto
filebeat.inputs:
- type: filestream
  id: my-filestream-id
  enabled: true
  paths:
    - /tmp/smb2.log
  parsers:
    multiline:
        type: pattern
        pattern: '^\['
        negate: true
        match: after
output.logstash:
  hosts: ["localhost:5044"]

```

logstash/conf.d/tmp.conf:

```auto
input {
        beats {
                port => 5044
        }
        stdin{}
}
filter {
}
output {
        stdout{}
}

```

log format is :

```auto
[2024/05/13 08:37:59.564313, 10, pid=52418, effective(0, 0), real(0, 0), class=smb2] ../../source3/smbd/smb2_server.c:4531(smbd_smb2_process_negprot)
  smbd_smb2_first_negprot: packet length 236
[2024/05/13 08:37:59.565358, 10, pid=52418, effective(0, 0), real(0, 0), class=smb2] ../../source3/smbd/smb2_server.c:2979(smbd_smb2_request_dispatch)
  smbd_smb2_request_dispatch: opcode[SMB2_OP_NEGPROT] mid = 0
[2024/05/13 08:37:59.566104, 3, pid=52418, effective(0, 0), real(0, 0), class=smb2] ../../source3/smbd/smb2_negprot.c:301(smbd_smb2_request_process_negprot)
  Selected protocol SMB3_11
[2024/05/13 08:37:59.575583, 10, pid=52418, effective(0, 0), real(0, 0), class=smb2] ../../source3/smbd/smb2_server.c:3840(smbd_smb2_request_done_ex)
  smbd_smb2_request_done_ex: mid [0] idx[1] status[NT_STATUS_OK] body[64] dyn[yes:156] at ../../source3/smbd/smb2_negprot.c:856

```

---

<div class="post-metadata">

**Author:** ![Fodesu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fodesu/32/134439_2.png) [@Fodesu](https://discuss.elastic.co/u/Fodesu)\
**Post date:** [May 14, 2024, 3:50am UTC](https://discuss.elastic.co/t/filebeat-cant-manage-multiline-message-with-office-example/359420/2 "2024-05-14T03:50:39Z")

</div>

ok i find my error is lack a “-” before parsers