# Filebeat multiline is not working as expected

**URL:** <https://discuss.elastic.co/t/filebeat-multiline-is-not-working-as-expected/165033>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [January 21, 2019, 10:41am UTC](https://discuss.elastic.co/t/filebeat-multiline-is-not-working-as-expected/165033 "2019-01-21T10:41:56Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Abu\_Tahir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abu_tahir/32/40015_2.png) [@Abu\_Tahir](https://discuss.elastic.co/u/Abu_Tahir)\
**Post date:** [January 21, 2019, 10:41am UTC](https://discuss.elastic.co/t/filebeat-multiline-is-not-working-as-expected/165033/1 "2019-01-21T10:41:56Z")

</div>

The below set of lines are my test log

```
[2016-08-24 11:49:14,389] Started new event
[2016-08-24 11:49:14,395] Content of processing something
[2016-08-24 11:49:14,399] End event
[2016-08-24 11:49:14,389] Started new event
[2016-08-24 11:49:14,395] Content of processing something
[2016-08-24 11:49:14,399] End event

```

my conf

```
- type: log

  # Change to true to enable this input configuration.
  enabled: true

  # Paths that should be crawled and fetched. Glob based paths.
  paths:
    - /Users/mac/logs/*.log
  multiline.pattern: '^*Started new event'
  multiline.negate: false
  multiline.match: after
  multiline.flush_pattern: '^*End event'

```

I am still seeing all the above logs are still going as individual logs . Not sure what am i doing wrong here

---

<div class="post-metadata">

**Author:** ![Tek\_Chand](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tek_chand/32/34318_2.png) [@Tek\_Chand](https://discuss.elastic.co/u/Tek_Chand)\
**Post date:** [January 22, 2019, 5:12am UTC](https://discuss.elastic.co/t/filebeat-multiline-is-not-working-as-expected/165033/2 "2019-01-22T05:12:00Z")

</div>

@Abu_Tahir,

The log you have provided above are seems already in single line logs because every line is started with date and time. Thats why you are getting these logs as single line logs.

Can you please elaborate more what you want to achieve?

Thanks.

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [January 22, 2019, 3:36pm UTC](https://discuss.elastic.co/t/filebeat-multiline-is-not-working-as-expected/165033/3 "2019-01-22T15:36:54Z")

</div>

I don't think you need `flush_pattern` at all.

You regex does not match you contents. I don't think `^*` is even valid, is this would mean something like "any number of line beginnings".

The multiline.match docs give some idea how the configs work: [https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html](https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html)

you patterns is like `bacbdcbec`, which you want to split into `bac`, `bdc`, `bec`. This can be achieved via:

```auto
multiline.pattern: 'Start new event'
multiline.negate: true
multiline.match: after

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 19, 2019, 3:36pm UTC](https://discuss.elastic.co/t/filebeat-multiline-is-not-working-as-expected/165033/4 "2019-02-19T15:36:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.