# Filebeat multiline equivalent of logstash "what"

**URL:** <https://discuss.elastic.co/t/filebeat-multiline-equivalent-of-logstash-what/83264>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [April 22, 2017, 2:56am UTC](https://discuss.elastic.co/t/filebeat-multiline-equivalent-of-logstash-what/83264 "2017-04-22T02:56:27Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![seventy-7](https://avatars.discourse-cdn.com/v4/letter/s/c37758/32.png) [@seventy-7](https://discuss.elastic.co/u/seventy-7)\
**Post date:** [April 22, 2017, 2:56am UTC](https://discuss.elastic.co/t/filebeat-multiline-equivalent-of-logstash-what/83264/1 "2017-04-22T02:56:27Z")

</div>

Hello.

I'm looking to append a java stacktrace to the previous log line which is the application error. I was previously able to achieve this in logstash with the following:

```
multiline {
            pattern => "(^.+Exception: .+)|(^\s+at .+)|(^\s+... \d+ more)|(^\s*Caused by:.+)"
            patterns_dir => "/opt/logstash/etc/patterns"
            what => "previous"
}

```

Is this possible in filebeat?

```
  pattern: '(^.+Exception: .+)|(^\s+at .+)|(^\s+... \d+ more)|(^\s*Caused by:.+)'
  negate: false
  match: after
  max_lines: 5000
```

---

<div class="post-metadata">

**Author:** ![seventy-7](https://avatars.discourse-cdn.com/v4/letter/s/c37758/32.png) [@seventy-7](https://discuss.elastic.co/u/seventy-7)\
**Post date:** [April 22, 2017, 3:05am UTC](https://discuss.elastic.co/t/filebeat-multiline-equivalent-of-logstash-what/83264/2 "2017-04-22T03:05:37Z")

</div>

Never mind. it works. Had an issue with the regex.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 20, 2017, 3:15am UTC](https://discuss.elastic.co/t/filebeat-multiline-equivalent-of-logstash-what/83264/3 "2017-05-20T03:15:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.