# Filebeat kafka input using multiline parser gives no output

**URL:** <https://discuss.elastic.co/t/filebeat-kafka-input-using-multiline-parser-gives-no-output/292290>\
**Category:** Beats\
**Tags:** filebeat, libbeat\
**Created:** [December 17, 2021, 9:58am UTC](https://discuss.elastic.co/t/filebeat-kafka-input-using-multiline-parser-gives-no-output/292290 "2021-12-17T09:58:58Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![rsniper](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rsniper/32/98764_2.png) [@rsniper](https://discuss.elastic.co/u/rsniper)\
**Post date:** [December 17, 2021, 9:58am UTC](https://discuss.elastic.co/t/filebeat-kafka-input-using-multiline-parser-gives-no-output/292290/1 "2021-12-17T09:58:58Z")

</div>

I have posted the issue on stackoverflow as well  
[Filebeat kafka input using multiline parser gives no output](https://stackoverflow.com/questions/70388481/filebeat-kafka-input-using-multiline-parser-gives-no-output)

Filebeat is configured to use input from kafka and output to file

When the multiline setting is turned off, the output is published to a file. But when kafka input is configured with **mutiline** , no output in the file(file is not even created)

Here is relevant filebeat configuration  
Filebeat is configured to use input from kafka and output to file

When the multiline setting is turned off, the output is published to a file. But when kafka input is configured with **mutiline** , no output in the file(file is not even created)

Here is relevant filebeat configuration

> Input configuration

```auto
filebeat.inputs:
  - type: kafka
    hosts:
      - <ip>:9092
    topics:
      - "my-multiline-log"
    group_id: "kafka-consumer-filebeat"
    parsers:
      - multiline:
          # type: pattern
          pattern: '^'
          negate: true
          match: after

```

> Output Configuration:

```auto
output.file:
  path: "/tmp/filebeat"
  filename: filebeat
# codec.format:
# string: '%{[message]}'

```

> Filebeat relevant logs

```auto
2021-12-16T11:02:34.551Z INFO [input.kafka] compat/compat.go:111 Input kafka starting {"id": "19A7FFEEC9EDFC04"}
2021-12-16T11:02:34.551Z INFO [input.kafka.kafka input] kafka/input.go:129 Starting Kafka input {"id": "19A7FFEEC9EDFC04", "hosts": ["<ip>:9092"]}
2021-12-16T11:02:38.158Z DEBUG [reader_multiline] multiline/pattern.go:142 Multiline event flushed because timeout reached.
2021-12-16T11:02:44.767Z DEBUG [reader_multiline] multiline/pattern.go:142 Multiline event flushed because timeout reached.
2021-12-16T11:02:51.481Z DEBUG [reader_multiline] multiline/pattern.go:142 Multiline event flushed because timeout reached.
2021-12-16T11:02:58.225Z DEBUG [reader_multiline] multiline/pattern.go:142 Multiline event flushed because timeout reached.
2021-12-16T11:03:04.555Z DEBUG cgroup/util.go:276 PID 1 contains a cgroups V2 path (0::/) but no V2 mountpoint was found.
This may be because metricbeat is running inside a container on a hybrid system.
To monitor cgroups V2 processess in this way, mount the unified (V2) hierarchy inside
the container as /sys/fs/cgroup/unified and start metricbeat with --system.hostfs.

```

Am I configuring something incorrectly?

P.S. disabling the `multiline` configuration and setting output codec to %message, I get the output as is as input. This ensures filebeat is able to read from kafka

---

<div class="post-metadata">

**Author:** ![rsniper](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rsniper/32/98764_2.png) [@rsniper](https://discuss.elastic.co/u/rsniper)\
**Post date:** [December 23, 2021, 5:27am UTC](https://discuss.elastic.co/t/filebeat-kafka-input-using-multiline-parser-gives-no-output/292290/2 "2021-12-23T05:27:39Z")

</div>

The support for multi-line parser has been added to filebeat in version 7.16

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 20, 2022, 7:28am UTC](https://discuss.elastic.co/t/filebeat-kafka-input-using-multiline-parser-gives-no-output/292290/3 "2022-01-20T07:28:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.