# Filebeat multiline message display

**URL:** <https://discuss.elastic.co/t/filebeat-multiline-message-display/251386>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [October 8, 2020, 7:26am UTC](https://discuss.elastic.co/t/filebeat-multiline-message-display/251386 "2020-10-08T07:26:53Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![vadrix](https://avatars.discourse-cdn.com/v4/letter/v/71c47a/32.png) [@vadrix](https://discuss.elastic.co/u/vadrix)\
**Post date:** [October 8, 2020, 7:26am UTC](https://discuss.elastic.co/t/filebeat-multiline-message-display/251386/1 "2020-10-08T07:26:53Z")

</div>

Hi.. i am trying to create multiline for "t message" on elasticsearch  
but it's always showing sing line for each log on elasticsearch  
this from elasticsearch  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/5/f5d346cbc52b44a2dddc472c38dcf9b76cb4dbd9.png)  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/2/32ed406597706b0a0adbd6c576ab08383ca1a773.png)  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/2/e231ac4b377c1b89b277932cfdaee1a7a174de89.png)

and this from logs file  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/8/f8952a82b7a9e9822ca05e5b83d76e62bfefd1ad.png)

on filebeat.inputs i am using this multiline config  
multiline.pattern: '^\A'  
multiline.negate: true  
multiline.match: after

kindly advise for correction  
thanks in advance 🙂

---

<div class="post-metadata">

**Author:** ![MarianaD](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marianad/32/42687_2.png) [@MarianaD](https://discuss.elastic.co/u/MarianaD)\
**Post date:** [October 8, 2020, 9:41am UTC](https://discuss.elastic.co/t/filebeat-multiline-message-display/251386/2 "2020-10-08T09:41:46Z")

</div>

hi @vadrix, can you provide us with maybe 2 examples from the log files in order to get a a better idea on where you want to separate the log lines?

---

<div class="post-metadata">

**Author:** ![vadrix](https://avatars.discourse-cdn.com/v4/letter/v/71c47a/32.png) [@vadrix](https://discuss.elastic.co/u/vadrix)\
**Post date:** [October 12, 2020, 2:56am UTC](https://discuss.elastic.co/t/filebeat-multiline-message-display/251386/3 "2020-10-12T02:56:41Z")

</div>

Hi Mariana,

here sample log from my server (showing 2 lines)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/9/597875545dc1f562790e25a2a7c13bebfeb5012a.png)

and here display log from elasticsearch, become 2 separated log

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/2/f216a037a576a94d697bf5d95e8ae5e15fed6018.png)

i want it shows in single log, something like this

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/d/4d82aee3d62b138af81d69fd383457d8cbf84ede.png)

thanks in advance

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 9, 2020, 4:56am UTC](https://discuss.elastic.co/t/filebeat-multiline-message-display/251386/4 "2020-11-09T04:56:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.