# Filebeat configuration : multiline.\* (working) vs parsers (not working)

**URL:** <https://discuss.elastic.co/t/filebeat-configuration-multiline-working-vs-parsers-not-working/348508>\
**Category:** Beats\
**Tags:** docker, filebeat\
**Created:** [December 3, 2023, 4:53pm UTC](https://discuss.elastic.co/t/filebeat-configuration-multiline-working-vs-parsers-not-working/348508 "2023-12-03T16:53:57Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jadam\_fr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jadam_fr/32/128553_2.png) [@jadam\_fr](https://discuss.elastic.co/u/jadam_fr)\
**Post date:** [December 3, 2023, 4:53pm UTC](https://discuss.elastic.co/t/filebeat-configuration-multiline-working-vs-parsers-not-working/348508/1 "2023-12-03T16:53:57Z")

</div>

Hi,

I'm a bit stumped trying to determine why this config using old-style `multine.*` conf values works :

```yaml
filebeat.inputs:
- type: stdin 
  id: multi-line-log-ex
  close_eof: true
  enabled: true

  multiline.pattern : '^\d'
  multiline.negate : true
  multiline.match : after

output.console:
  pretty: true

```

But this one using the new parsers config does not:

```yaml
filebeat.inputs:
- type: stdin
  id: multi-line-log-ex
  close_eof: true
  enabled: true
  parsers:
    - multiline:
        type: pattern
        pattern: '^\d'
        negate: true
        match: after

output.console:
  pretty: true

```

It could be some kind of YAML indentation issue but the documentation does not help as is doesn't provide complete YAML files, only snippets.

There's also not much in the FileBeat logs to indicate what it has or has not understood about the config file. Some kind of flag that would dump the configuration, as understood and parsed into the FileBeat logs would be a godsend. Or maybe the `test config` option could dump the whole config instead of just "Config OK"...

For reference here is a sample log:

```auto
2010-04-10T21:40:03.625Z|| Some message
2010-04-10T21:41:03.625Z|| foo - Exception occurred
Exception details
        at foo(foo.java):92
        at bar(bar.java):18
2010-04-10T21:42:03.625Z|| Another message

```

And the command line I'm using the test it out (Docker on Windows, so you may need to change paths etc.)

```auto
cat .\logs\sample.log | docker run -i --rm -v "${PWD}\filebeat.yml:/usr/share/filebeat/filebeat.yml:ro" docker.elastic.co/beats/filebeat:8.11.1 run --once --strict.perms=false -e

```

Cheers,

Adam

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [December 3, 2023, 7:42pm UTC](https://discuss.elastic.co/t/filebeat-configuration-multiline-working-vs-parsers-not-working/348508/2 "2023-12-03T19:42:23Z")

</div>

Heya @jadam_fr Welcome to the community...

Yeah.... bit of a legacy vs new... `stdin` does not support the `parsers` syntax, just the original `multiline` some of the new inputs such as `filestream` support the `parsers` syntax but not the legacy syntax

So you need to look at each input and see what is supported... yeah a bit messy right now.... Keeping our users on their toes... 🙂

---

<div class="post-metadata">

**Author:** ![jadam\_fr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jadam_fr/32/128553_2.png) [@jadam\_fr](https://discuss.elastic.co/u/jadam_fr)\
**Post date:** [December 3, 2023, 8:21pm UTC](https://discuss.elastic.co/t/filebeat-configuration-multiline-working-vs-parsers-not-working/348508/3 "2023-12-03T20:21:12Z")

</div>

Thanks, that makes sense !

I was trying `stdin` to narrow down the problem I was having with `filestream` originally but going back to `filestream` fixed the initial issue.

I'm sure it'll all settle down in a few versions, thanks again.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 31, 2023, 10:21pm UTC](https://discuss.elastic.co/t/filebeat-configuration-multiline-working-vs-parsers-not-working/348508/4 "2023-12-31T22:21:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.