# Filebeat multiline - escaping curly parenthesis
**URL:** https://discuss.elastic.co/t/filebeat-multiline-escaping-curly-parenthesis/62092
**Category:** Beats
**Tags:** filebeat
**Created:** [October 3, 2016, 4:43pm UTC](https://discuss.elastic.co/t/filebeat-multiline-escaping-curly-parenthesis/62092 "2016-10-03T16:43:59Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@zoplex](https://discuss.elastic.co/u/zoplex)
#### Post date: [October 3, 2016, 4:43pm UTC](https://discuss.elastic.co/t/filebeat-multiline-escaping-curly-parenthesis/62092/1 "2016-10-03T16:43:59Z")
We have filebeat.yml that processes multiline filter as:
```
multiline:
pattern: '^\{Heap before'
negate: true
match: after
```
we want to start new record whenever the pattern "{Heap before" is encountered;
we see occasionally that records are unnecessary split - almost like '{' was not considered as part of the record start - are we escaping it unnecessary ? Or is that escape syntax incorrect?
Thanks
---
### Author:  [@zoplex](https://discuss.elastic.co/u/zoplex)
#### Post date: [October 3, 2016, 4:53pm UTC](https://discuss.elastic.co/t/filebeat-multiline-escaping-curly-parenthesis/62092/2 "2016-10-03T16:53:03Z")
.. seems that on some servers first part of the multiline record (about 10 lines) is written to the observed log file - then filebeat takes it and sends it up to logstash although not the full multiline record has been seen; so basically multiline logic applies only as long as the full multiline pattern is already in the log file - filebeat will NOT wait for the rest to be there before it processes it?
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [October 3, 2016, 5:26pm UTC](https://discuss.elastic.co/t/filebeat-multiline-escaping-curly-parenthesis/62092/3 "2016-10-03T17:26:09Z")
> [@zoplex](#):
>
> are we escaping it unnecessary ? Or is that escape syntax incorrect?
In YAML, single quoted strings do not support (or require) escaping. [http://www.yaml.org/spec/1.2/spec.html#id2788097](http://www.yaml.org/spec/1.2/spec.html#id2788097)
Then since this string is compiled into a regex it would require escaping if it were a special character or ambiguous. But in either case, escaping or not-escaping it will match. See [Go Playground - The Go Programming Language](https://play.golang.org/p/gOYjj5P3J7)
---
### Author:  [@zoplex](https://discuss.elastic.co/u/zoplex)
#### Post date: [October 3, 2016, 6:12pm UTC](https://discuss.elastic.co/t/filebeat-multiline-escaping-curly-parenthesis/62092/4 "2016-10-03T18:12:05Z")
Thanks Andrew - so escaping is not an issue here then ... I am assuming that it is the second point above - that filebeat is processing what is written into observer log file - and sending it up even if the full multiline is not there yet - for example if first 10 lines of 15 line multiline are written into the log file now and then the other 5 lines are written 2 minutes later - we will not get complete multiline - filebeat will send first 10 lines and will not wait for two more minutes to get the rest - even if pattern calls for that?
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [October 3, 2016, 6:23pm UTC](https://discuss.elastic.co/t/filebeat-multiline-escaping-curly-parenthesis/62092/5 "2016-10-03T18:23:49Z")
You can try to increase the [timeout](https://www.elastic.co/guide/en/beats/filebeat/1.3/configuration-filebeat-options.html) to test your theory. The default is 5s.
```auto
multiline:
pattern: '^\{Heap before'
negate: true
match: after
timeout: 60m
```
The downside is that the longer the timeout, the more latency you have with some log lines showing up in ES.
---
### Author:  [@zoplex](https://discuss.elastic.co/u/zoplex)
#### Post date: [October 3, 2016, 6:25pm UTC](https://discuss.elastic.co/t/filebeat-multiline-escaping-curly-parenthesis/62092/6 "2016-10-03T18:25:10Z")
Thank you - will do that! Much appreciated!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 24, 2016, 4:44pm UTC](https://discuss.elastic.co/t/filebeat-multiline-escaping-curly-parenthesis/62092/7 "2016-10-24T16:44:03Z")
This topic was automatically closed after 21 days. New replies are no longer allowed.