# Filebeat multiline is not working **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [March 30, 2018, 2:48pm UTC](https://discuss.elastic.co/t/filebeat-multiline-is-not-working/126242 "2018-03-30T14:48:41Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Babul\_Kumar\_Sahoo](https://avatars.discourse-cdn.com/v4/letter/b/aca169/32.png) [@Babul\_Kumar\_Sahoo](https://discuss.elastic.co/u/Babul_Kumar_Sahoo)\ **Post date:** [March 30, 2018, 2:48pm UTC](https://discuss.elastic.co/t/filebeat-multiline-is-not-working/126242/1 "2018-03-30T14:48:41Z")
Hi, I have configure the filebeat to tomcat log and below is my filebeat multiline configuration: multiline.pattern: "^(\s+|\t)|(Caused by:)|(Exception:)|(System Error:)" multiline.negate: false multiline.match: after multiline.flush\_pattern: "^((?!\t).)" So here is the below output, when i pasted the below to the tomcat log at same time: 18:18:24.891 QL t@-1858021632 End Command 18:18:24.891 VERB t@-1858021632 input params: (session=EDF3EA6DABE00B000C67E987ECF84A82.v6dp1-01:mx810075420afc940d6:(ApproveRejectProcess\_jsp.java:383)), type=Java, msg=CLASS LOADER Exception: System Error: #5000001: Error: #1900068: java.lang.NullPointerException Exception: java.lang.NullPointerException at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:606) 18:18:24.891 VERB t@-1858021632 input params: cmd=unset env USER, allowMultipleOverride=0 OUTPUT: { "host" =\> "localhost.localdomain", "@version" =\> "1", "prospector" =\> { "type" =\> "log" }, "tags" =\> [ [0] "beats\_input\_codec\_plain\_applied", [1] "\_grokparsefailure" ], "message" =\> "18:18:24.891 QL t@-1858021632 End Command\n18:18:24.891 VERB t@-1858021632 input params: (session=EDF3EA6DABE00B000C67E987ECF84A82.v6dp1-01:mx810075420afc940d6:(ApproveRejectProcess\_jsp.java:383)), type=Java, msg=CLASS LOADER Exception: System Error: #5000001: Error: #1900068: java.lang.NullPointerException\nException: java.lang.NullPointerException\n\tat sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)\n\tat sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)\n\tat sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)\n\tat java.lang.reflect.Method.invoke(Method.java:606)", "@timestamp" =\> 2018-03-30T14:42:55.405Z, "source" =\> "/Tomcat Logs/output.txt", "offset" =\> 656, "beat" =\> { "name" =\> "localhost.localdomain", "version" =\> "6.2.3", "hostname" =\> "localhost.localdomain" } } If you see the message, it combine all the things i pasted. Rather than to combine only the exception part. I checked the same in [https://play.golang.org/p/uAd5XHxscu](https://play.golang.org/p/uAd5XHxscu) and below is the output. matches line false 18:18:24.891 QL t@-1858021632 End Command true 18:18:24.891 VERB t@-1858021632 input params: (session=EDF3EA6DABE00B000C67E987ECF84A82.v6dp1-01:mx810075420afc940d6:(ApproveRejectProcess\_jsp.java:383)), type=java, msg=CLASS LOADER Exception: System Error: #5000001: Error: #1900068: java.lang.NullPointerException true Exception: java.lang.NullPointerException true at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) true at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57) true at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) true at java.lang.reflect.Method.invoke(Method.java:606) false 18:18:24.891 VERB t@-1858021632 input params: cmd=unset env USER, allowMultipleOverride=0 false So here i except, all the true line should come to output as one event. And all the false one will come in individual event to the output. But actually, the ouput combines all. Exception (those are marked true in above) and all the false on single output event. Please let me know, how to fix this. Or please let me know, how to configure the filebeat to consider each entry to log file as individual event unless and until it matches the multiline regex. Thank You. ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [April 3, 2018, 12:50pm UTC](https://discuss.elastic.co/t/filebeat-multiline-is-not-working/126242/2 "2018-04-03T12:50:26Z")
Please format logs, configs and terminal input/output using the ``-Button or [markdown code fences](https://help.github.com/articles/creating-and-highlighting-code-blocks/#fenced-code-blocks). This forum uses Markdown to format posts. Without proper formatting, it can be very hard to read your posts. Config files using YAML are sensitive to formatting and indentation. Without proper formatting it is difficult to spot any errors in your configs. Please include the full context of your multiline configuration (config file until multiline config, including indentation). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 1, 2018, 12:50pm UTC](https://discuss.elastic.co/t/filebeat-multiline-is-not-working/126242/3 "2018-05-01T12:50:29Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.