# Filebeat : How to get multiline logs together (with pattern) in one block
**URL:** https://discuss.elastic.co/t/filebeat-how-to-get-multiline-logs-together-with-pattern-in-one-block/299971
**Category:** Beats
**Tags:** filebeat
**Created:** [March 17, 2022, 3:50pm UTC](https://discuss.elastic.co/t/filebeat-how-to-get-multiline-logs-together-with-pattern-in-one-block/299971 "2022-03-17T15:50:29Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@MLAYEH\_Ismail](https://discuss.elastic.co/u/MLAYEH_Ismail)
#### Post date: [March 17, 2022, 3:50pm UTC](https://discuss.elastic.co/t/filebeat-how-to-get-multiline-logs-together-with-pattern-in-one-block/299971/1 "2022-03-17T15:50:29Z")
Hi everyone, im working on extracting log by filebeat and processing it by ELK stack.
every thing works exept that the logs are readed line per line and not by block with the specified pattern . thank you in advance.
this is my filebeat.inputs :
- type: log
enabled: true
paths:
- C:\Users\ismailm\Desktop\lineup\*.log
multiline:
pattern: 'http\>^['
negate: true
match: after
flush\_pattern: 'http\> Response'
log example :
http\> [02/03/2022 08:47:28] GET /star/multisession/x-707780/CommandProcessor?RGICommand=inquiryNodoRvFiltro&RGIResponseOk=${EXTRES}/portafoglio/common/ToolFinderRV.html&LABEL\_NODO\_ID=PrpvIdpv&LABEL\_NODO\_DESCR=PrpvCdescrizione1&showOnlyValidNodes=true&LABEL\_NOME\_FORM=RGI\_FORM\_DT
RGI\> (0 rows in 1~1 msec) Select \* From PRMANDATO Where ( IDPVFISICO=? And dInizio\<=? And (dFine\>? Or dFine Is Null) ) Order By IDCOMPAGNIA [1,{d '2022-03-02'},{d '2022-03-02'}]
http\> Response in 15 msec. RGIResponseOk="/star/res2/portafoglio/common/ToolFinderRV.html"
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [March 17, 2022, 3:59pm UTC](https://discuss.elastic.co/t/filebeat-how-to-get-multiline-logs-together-with-pattern-in-one-block/299971/2 "2022-03-17T15:59:33Z")
> [@MLAYEH\_Ismail](#):
>
> pattern: 'http\>^['
I think this pattern is wrong, the `^` should be used when your pattern needs to start with some expression, also if I'm not wrong you need to escape the square bracket.
Can you change it to `^http>\s\[` and try again?
---
### Author:  [@MLAYEH\_Ismail](https://discuss.elastic.co/u/MLAYEH_Ismail)
#### Post date: [March 17, 2022, 4:07pm UTC](https://discuss.elastic.co/t/filebeat-how-to-get-multiline-logs-together-with-pattern-in-one-block/299971/3 "2022-03-17T16:07:22Z")
it works for me and gives me the same result.
the problem that when the logs generated line per line and the filebeat send hits for every new line but i need to send a hit for every multiline block with the specified pattern
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [March 17, 2022, 4:10pm UTC](https://discuss.elastic.co/t/filebeat-how-to-get-multiline-logs-together-with-pattern-in-one-block/299971/4 "2022-03-17T16:10:00Z")
What is the result you are getting?
If you are getting an output line by line from filebeat, then the multiline pattern is not working.
What is the filebeat version you are using?
---
### Author:  [@MLAYEH\_Ismail](https://discuss.elastic.co/u/MLAYEH_Ismail)
#### Post date: [March 17, 2022, 4:14pm UTC](https://discuss.elastic.co/t/filebeat-how-to-get-multiline-logs-together-with-pattern-in-one-block/299971/5 "2022-03-17T16:14:46Z")
version : 8.0.1
the output is a message contain a block as expected when i enter the log(manually) by block and get all the block in one hit , otherwise in real logs the lines will be added line per line in the log file , and the file beat collect them one by one , or i need the filebeat to collect the block when the pattern is completed , because i m applyin a grok pattern on it
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 14, 2022, 6:15pm UTC](https://discuss.elastic.co/t/filebeat-how-to-get-multiline-logs-together-with-pattern-in-one-block/299971/6 "2022-04-14T18:15:17Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.