# Filebeat multiline configuration issue

**URL:** <https://discuss.elastic.co/t/filebeat-multiline-configuration-issue/118934>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [February 7, 2018, 10:29pm UTC](https://discuss.elastic.co/t/filebeat-multiline-configuration-issue/118934 "2018-02-07T22:29:46Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![zozo6015](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zozo6015/32/12117_2.png) [@zozo6015](https://discuss.elastic.co/u/zozo6015)\
**Post date:** [February 7, 2018, 10:29pm UTC](https://discuss.elastic.co/t/filebeat-multiline-configuration-issue/118934/1 "2018-02-07T22:29:46Z")

</div>

Hello,

I am trying to parse a java log file using filebeat with multiline. The `filebeat.yml` looks like this:

```
filebeat.prospectors:
  - type: log
    enabled: true
   paths:
     - /home/jetty/logs/*.log
   tags: ["jetty"]
   fields_under_root: true
   fields:
      service: jetty
   multiline.pattern: ^[A-Z]{3} [0-9]{2}, [0-9]{4} [0-9]{2}:[0-9]{2}:[0-9]{2} [A,P]M
   multiline.negate: true
   multiline.match: after
   multiline.flush_pattern: ^[A-Z]{3} [0-9]{2}, [0-9]{4} [0-9]{2}:[0-9]{2}:[0-9]{2} [A,P]M

```

in logstash I am getting everything in one message and files are not split up in different packets following the multiline.pattern rule. As in the following example:

[https://pastebin.com/MqxrB4TY](https://pastebin.com/MqxrB4TY)

Any suggestion?

Thanks in advance

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [February 8, 2018, 11:45pm UTC](https://discuss.elastic.co/t/filebeat-multiline-configuration-issue/118934/2 "2018-02-08T23:45:48Z")

</div>

I don't really understand. Is the problem with multiline or do you want help with parsing?

What exactly does your input look like? How do you want your output to look like?

The pastebin seems to suggest that you basically send the complete file's contents as one event to logstash. This correct? Why not have filebeat send the single log lines as events?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 8, 2018, 11:45pm UTC](https://discuss.elastic.co/t/filebeat-multiline-configuration-issue/118934/3 "2018-03-08T23:45:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.