# Filebeat exclude lines with multiline

**URL:** <https://discuss.elastic.co/t/filebeat-exclude-lines-with-multiline/312171>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [August 16, 2022, 11:01am UTC](https://discuss.elastic.co/t/filebeat-exclude-lines-with-multiline/312171 "2022-08-16T11:01:56Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![inhinyera16](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/inhinyera16/32/61625_2.png) [@inhinyera16](https://discuss.elastic.co/u/inhinyera16)\
**Post date:** [August 16, 2022, 11:01am UTC](https://discuss.elastic.co/t/filebeat-exclude-lines-with-multiline/312171/1 "2022-08-16T11:01:56Z")

</div>

Hello,

Is there any way we can exclude the lines first before splitting the logs via multiline pattern?  
I have one specific logs with 3 different log patterns, the problem is, the output is incorrect due the extra lines

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/e/6edad2bb044b4d4704eeed3c095fb8dee8164d01.png)

Here's my config

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/5/f5b83e875dd2601ca76d7a683827c59e62e209ab.png)

this is how it looked like in kibana

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/3/4374f66bf3ef9efe56c06d6a69003f4182a0c6d5.png)

Without the extraline, the pattern should work

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/5/d5c2c210576f70737ba74014e2ef14978fa1e75a.png)

---

<div class="post-metadata">

**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\
**Post date:** [August 22, 2022, 3:34pm UTC](https://discuss.elastic.co/t/filebeat-exclude-lines-with-multiline/312171/2 "2022-08-22T15:34:27Z")

</div>

Hey @inhinyera16,

Take a look to the [`filestream`](https://www.elastic.co/guide/en/beats/filebeat/8.3/filebeat-input-filestream.html) input and its [`parsers` option](https://www.elastic.co/guide/en/beats/filebeat/8.3/filebeat-input-filestream.html#_parsers). It allows to select on what order multiline and other parsing options happen.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 19, 2022, 5:35pm UTC](https://discuss.elastic.co/t/filebeat-exclude-lines-with-multiline/312171/3 "2022-09-19T17:35:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.