# Filebeat multiline Issue

**URL:** <https://discuss.elastic.co/t/filebeat-multiline-issue/279338>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [July 22, 2021, 5:41am UTC](https://discuss.elastic.co/t/filebeat-multiline-issue/279338 "2021-07-22T05:41:46Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![gangireddy\_l](https://avatars.discourse-cdn.com/v4/letter/g/c89c15/32.png) [@gangireddy\_l](https://discuss.elastic.co/u/gangireddy_l)\
**Post date:** [July 22, 2021, 5:41am UTC](https://discuss.elastic.co/t/filebeat-multiline-issue/279338/1 "2021-07-22T05:41:46Z")

</div>

Hi Team,

I have an issue in filebeat Multiline pattern, below are my logs and filebeat configuration.

sample\_logs

```auto
	21-04-01 Name Succ Fail Reject Thrput Response time (ms)
																   (/s) Avg Min Max
	00:00:00 Total sum 7 1 0 0 1467 1235 1715
			  event 7 1 0 0 1467 1235 1715
	00:00:10 Total sum 7 2 0 0 1257 418 2948
			  event 7 2 0 0 1257 418 2948
	00:00:20 Total sum 8 3 0 0 1257 231 1981
			  event 8 3 0 0 1257 231 1981
	21-04-01 Name Succ Fail Reject Thrput Response time (ms)
																   (/s) Avg Min Max
	00:02:00 Total sum 7 1 0 0 1467 1235 1715
			  event 7 1 0 0 1467 1235 1715
	00:02:10 Total sum 7 2 0 0 1257 418 2948
			  event 7 2 0 0 1257 418 2948
	00:03:20 Total sum 8 3 0 0 1257 231 1981
			  event 8 3 0 0 1257 231 1981	

```

```auto
# Filebeat Multiline configuration
  multiline.pattern: Name
  multiline.negate: true
  multiline.match: after
  ignore_older: 24h

```

My Issue:  
with above configuration multiline pattern is working fine, if whole logs arrive at a time in log file. But if there is a delay (like last 2 lines) last 2 lines of logs is sending as separate event.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 19, 2021, 7:42am UTC](https://discuss.elastic.co/t/filebeat-multiline-issue/279338/2 "2021-08-19T07:42:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.