# Filebeat multiline and other questions **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [November 8, 2017, 8:53am UTC](https://discuss.elastic.co/t/filebeat-multiline-and-other-questions/106821 "2017-11-08T08:53:36Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Eduard3000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/eduard3000/32/23943_2.png) [@Eduard3000](https://discuss.elastic.co/u/Eduard3000)\ **Post date:** [November 8, 2017, 8:53am UTC](https://discuss.elastic.co/t/filebeat-multiline-and-other-questions/106821/1 "2017-11-08T08:53:36Z")
Hi, I am trying to write a jvm verbose gclog filebeat module: - where is the right place to set the multiline option? - how do I tell elastic to use my pipeline.json with grok filters as ingest pipeline. - how to extend the filebeat.template.json and load automatically? Sorry the how to get started with beats guide is far from complete to answer this all sufficiently. Thanks for reading, great if you had answers. Regards, Eduard ---
**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\ **Post date:** [November 9, 2017, 10:53am UTC](https://discuss.elastic.co/t/filebeat-multiline-and-other-questions/106821/2 "2017-11-09T10:53:11Z")
Hi! What version of Filebeat are you using? - `filebeat/module/yourmodule/yourfileset/config/yourfileset.yml` is the file which includes multiline configuration. Where yourmodule is the name of your module and yourfileset is the name of your fileset. - If your pipeline is in the standard place, it will load automatically. However, it is not there, you can configure it in the `manifest.yml`. - To generate required files, you need to call `make update`. After it is generated, Filebeat loads it automatically on startup. Are you referring to this guide? [https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-modules-devguide.html](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-modules-devguide.html) ---
**Author:** ![Eduard3000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/eduard3000/32/23943_2.png) [@Eduard3000](https://discuss.elastic.co/u/Eduard3000)\ **Post date:** [November 9, 2017, 1:00pm UTC](https://discuss.elastic.co/t/filebeat-multiline-and-other-questions/106821/3 "2017-11-09T13:00:07Z")
Hi Noémi, thanks, I think I did that all, but maybe with intermediate steps. So far it wont eat all lines (only the first) after the negated regex. Will setup a dev elastic environment and do it like that in one go and see if it works out like that. Regards, Eduard ---
**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\ **Post date:** [November 10, 2017, 10:06am UTC](https://discuss.elastic.co/t/filebeat-multiline-and-other-questions/106821/4 "2017-11-10T10:06:59Z")
There is an extensive guide on multiline and also a Playground where you can test you events: [https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html](https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html) If it still does not work, please share your logs and multiline config. ---
**Author:** ![Eduard3000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/eduard3000/32/23943_2.png) [@Eduard3000](https://discuss.elastic.co/u/Eduard3000)\ **Post date:** [November 10, 2017, 10:44am UTC](https://discuss.elastic.co/t/filebeat-multiline-and-other-questions/106821/5 "2017-11-10T10:44:43Z")
Hello Noémi, I saw that and retestet my multiline setup and looks fine there. Give me some time to setup an elastic test env and I will let you know if it works doing it all in one go. Have a nice weekend. Regards, Eduard ---
**Author:** ![Eduard3000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/eduard3000/32/23943_2.png) [@Eduard3000](https://discuss.elastic.co/u/Eduard3000)\ **Post date:** [November 13, 2017, 9:10am UTC](https://discuss.elastic.co/t/filebeat-multiline-and-other-questions/106821/6 "2017-11-13T09:10:57Z")
Hi Noémi, ok the multiline is ok now. But I have another issue, I can open a new thread or just ask: the make update creates a template for the fields, but there is also \_meta/fields.yml and it seems those fields get added too!? Short: how/where to place the fields for my module, and how to add them to the template to be created inside the index(pattern)? Edit\> so adding the new fields to \_meta/fields.yml is enough, filebeat adds these to the index/template automagically. I will do some more tests when done @kvch: where is the best place to propose new modules/comunity beats? Well mine is more an example, there are some prework to do adopting my verbose gc log parser to another java version or gc type (the output pattern my differ) Thanks again for your advice. Regards, Eduard ---
**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\ **Post date:** [November 15, 2017, 8:02pm UTC](https://discuss.elastic.co/t/filebeat-multiline-and-other-questions/106821/7 "2017-11-15T20:02:18Z")
Yes, indeed. You can submit your requests here: [https://github.com/elastic/beats/issues](https://github.com/elastic/beats/issues) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 29, 2017, 8:53am UTC](https://discuss.elastic.co/t/filebeat-multiline-and-other-questions/106821/8 "2017-11-29T08:53:37Z")
This topic was automatically closed after 21 days. New replies are no longer allowed.