# Filebeat merge lines when we do not need that

**URL:** <https://discuss.elastic.co/t/filebeat-merge-lines-when-we-do-not-need-that/120853>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [February 21, 2018, 1:43pm UTC](https://discuss.elastic.co/t/filebeat-merge-lines-when-we-do-not-need-that/120853 "2018-02-21T13:43:59Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![uvali](https://avatars.discourse-cdn.com/v4/letter/u/ce73a5/32.png) [@uvali](https://discuss.elastic.co/u/uvali)\
**Post date:** [February 21, 2018, 1:43pm UTC](https://discuss.elastic.co/t/filebeat-merge-lines-when-we-do-not-need-that/120853/1 "2018-02-21T13:43:59Z")

</div>

Hi,

I have a strange problem with Filebeat, it combines lines.  
In the below example the line with "TID ... DEBUG" is merged in one single line with the next which contain "TID...INFO"  
In fact they are separate lines in the log file.

//2018-02-21T14:46:08+02:00 DBG Drop line as it does match one of the exclude patternsTID: [-1] [] [2018-02-21 14:46:07,241] DEBUG {org.apache.synapse.transport.http.heaJAdzBtMTc= {org.apache.synapse.transport.http.headers}  
TID: [-1234] [] [2018-02-21 14:46:07,243] INFO {org.apache.synapse.mediators.builtin.LogMediator} - To: /services/Ji2W, WSAction: [http://www.example.org/Ji2W/sWO](http://www.example.org/Ji2W/sWO), MessageID: urn:uuid:64ae393e-ac3a-4ae0-a259-10a079821557, Direction: request, st = start\_log\_info, flow = Ji2W, messageStep = 1, initiator = Jira, transactionT encoding='utf-8'?\>\<env:Envelope xmlns:env="[http://www.w3.org/2003/05/soap-envelope](http://www.w3.org/2003/05/soap-envelope)"\>env:Body\<ns3:checkStatus xmlns:ns3="[http://www.example.org/Ji2W/](http://www.example.org/Ji2W/)"\> {org.apache.synapse.mediators.builtin.LogMediator}

And in filebeat.yml I have an exclude directive:  
//exclude\_lines: ['^(?m)TID._DEBUG._$','^(?m)TID._ERROR._$']  
which drop also the INFO line.

Any ideas?

Thanks,  
uvali

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 21, 2018, 1:44pm UTC](https://discuss.elastic.co/t/filebeat-merge-lines-when-we-do-not-need-that/120853/2 "2018-03-21T13:44:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.