# Filebeat cut multiline on 500 line

**URL:** <https://discuss.elastic.co/t/filebeat-cut-multiline-on-500-line/104086>\
**Category:** Beats\
**Created:** [October 16, 2017, 11:22am UTC](https://discuss.elastic.co/t/filebeat-cut-multiline-on-500-line/104086 "2017-10-16T11:22:37Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dees7](https://avatars.discourse-cdn.com/v4/letter/d/2bfe46/32.png) [@Dees7](https://discuss.elastic.co/u/Dees7)\
**Post date:** [October 16, 2017, 11:22am UTC](https://discuss.elastic.co/t/filebeat-cut-multiline-on-500-line/104086/1 "2017-10-16T11:22:37Z")

</div>

I use Filebeat to send logs to remote logstash.  
I use multiline

```
- input_type: log
  paths:
    - /production_xml.log
  multiline.pattern: '^Response_id|^Request_id'
  multiline.negate: true
  multiline.match: after

```

My log about 900 lines and looks like:

```
Response_id: 20171016133116502015851
Response_time: 2017-10-16 13:31:16 +0500
Response_body: <?xml version="1.0" encoding="UTF-8"?>
<result>
  ...
    ~900lines
  ...
</result>

```

But I see first 500 lines in logstash. As result xml-paser writes in logs:

```
No close tag for /result/query_ns[11]

```

Why Filebeat cut on 500 line? is it possible to fix?

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [October 16, 2017, 11:43am UTC](https://discuss.elastic.co/t/filebeat-cut-multiline-on-500-line/104086/2 "2017-10-16T11:43:51Z")

</div>

Also set `multiline.max_lines: 1000`. The default is 500 lines. The `max_bytes` setting also limits event sizes to 10MB by default.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 6, 2017, 11:22am UTC](https://discuss.elastic.co/t/filebeat-cut-multiline-on-500-line/104086/3 "2017-11-06T11:22:47Z")

</div>

This topic was automatically closed after 21 days. New replies are no longer allowed.