# Filebeat in Container mode + multiline Parser

**URL:** <https://discuss.elastic.co/t/filebeat-in-container-mode-multiline-parser/320945>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [December 10, 2022, 11:09am UTC](https://discuss.elastic.co/t/filebeat-in-container-mode-multiline-parser/320945 "2022-12-10T11:09:25Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![fidelgonzo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fidelgonzo/32/114488_2.png) [@fidelgonzo](https://discuss.elastic.co/u/fidelgonzo)\
**Post date:** [December 10, 2022, 11:09am UTC](https://discuss.elastic.co/t/filebeat-in-container-mode-multiline-parser/320945/1 "2022-12-10T11:09:25Z")

</div>

I have a problem with Filebeat (7.17) that when trying to read multiline Java Stacktrace logs, it works without problems when _input.type: filestream_ but when running the same in our Kubernetes stack, as _input.type: container_ then the multiline parser is not picked up.

My config:

```auto
filebeat.inputs:
      - type: container
        paths:
          - /var/log/containers/*.log
        parsers:
        - multiline:
            type: pattern
            pattern: '^[[:space:]]+(at|\.{3})[[:space:]]+\b|^Caused by:'
            negate: false
            match: after

```

or is there another workaround to receive Java Stacktraces as single message entries in Elastic?  
We are using K8S Filebeat pods \> Elastic + Ingest Pipelines at the moment.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [December 10, 2022, 5:47pm UTC](https://discuss.elastic.co/t/filebeat-in-container-mode-multiline-parser/320945/2 "2022-12-10T17:47:32Z")

</div>

Hi @fidelgonzo Welcome to the community.

Hmmmm...  
It's possible I would have to check the container input is still using the older log input under the covers and thus it would use the older [multi-line syntax](https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html)

> If you still use the deprecated log input, there is no need to use parsers.

```auto
multiline.type: pattern
multiline.pattern: '^\['
multiline.negate: true
multiline.match: after

```

But I thought that got updated but you could check that.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 7, 2023, 7:48pm UTC](https://discuss.elastic.co/t/filebeat-in-container-mode-multiline-parser/320945/3 "2023-01-07T19:48:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.