# Filebeat include\_lines to match multiple regexes in the same multilines?

**URL:** <https://discuss.elastic.co/t/filebeat-include-lines-to-match-multiple-regexes-in-the-same-multilines/128474>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [April 18, 2018, 7:39am UTC](https://discuss.elastic.co/t/filebeat-include-lines-to-match-multiple-regexes-in-the-same-multilines/128474 "2018-04-18T07:39:16Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![sinaowolabi](https://avatars.discourse-cdn.com/v4/letter/s/74df32/32.png) [@sinaowolabi](https://discuss.elastic.co/u/sinaowolabi)\
**Post date:** [April 18, 2018, 7:39am UTC](https://discuss.elastic.co/t/filebeat-include-lines-to-match-multiple-regexes-in-the-same-multilines/128474/1 "2018-04-18T07:39:17Z")

</div>

Hi

I am trying to use filebeat to read multiple log files, from different applications but I want it to include only lines that have three matches in the lines.  
For example, lines that have both  
'\ssession\_timing\s' and '"from\_house":\s"\*123', and  
'\ssession\_timing\s' and '"to\_house":\s"\*456'.  
please how to I format my include\_lines configuration to filter these correctly?

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [April 18, 2018, 12:21pm UTC](https://discuss.elastic.co/t/filebeat-include-lines-to-match-multiple-regexes-in-the-same-multilines/128474/2 "2018-04-18T12:21:46Z")

</div>

My first guess is this configuration:

```auto
  include_lines: ['\session_timing\s.*""from_house":\s"\*123', '\ssession_timing\s.*""to_house"\s"*456']

```

Could you please share a few example logs you want to be matched by these regexes? It would make it easier to come up with proper regexes. 🙂

---

<div class="post-metadata">

**Author:** ![sinaowolabi](https://avatars.discourse-cdn.com/v4/letter/s/74df32/32.png) [@sinaowolabi](https://discuss.elastic.co/u/sinaowolabi)\
**Post date:** [April 19, 2018, 4:36pm UTC](https://discuss.elastic.co/t/filebeat-include-lines-to-match-multiple-regexes-in-the-same-multilines/128474/3 "2018-04-19T16:36:26Z")

</div>

Thanks!  
Your configuration makes a lot of sense.  
I should have mentioned in the question that session timing comes after from/to \_house.

Thanks again!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 17, 2018, 4:36pm UTC](https://discuss.elastic.co/t/filebeat-include-lines-to-match-multiple-regexes-in-the-same-multilines/128474/4 "2018-05-17T16:36:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.