# Filebeat Multiline multiple patterns

**URL:** <https://discuss.elastic.co/t/filebeat-multiline-multiple-patterns/45335>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 24, 2016, 11:02am UTC](https://discuss.elastic.co/t/filebeat-multiline-multiple-patterns/45335 "2016-03-24T11:02:35Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![moncky](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/moncky/32/6320_2.png) [@moncky](https://discuss.elastic.co/u/moncky)\
**Post date:** [March 24, 2016, 11:02am UTC](https://discuss.elastic.co/t/filebeat-multiline-multiple-patterns/45335/1 "2016-03-24T11:02:35Z")

</div>

I have a log file that has multiple, multi line events.

For example I have:

```
[24-Mar-2016 03:27:31] PHP Stack trace:
[24-Mar-2016 03:27:31] PHP 1. {main}() /home/app/www/myapp.com/feed/feed.php:0
[24-Mar-2016 03:27:31] PHP 2. require_once() /home/app/www/myapp.com/feed/feed.php:6
[24-Mar-2016 03:27:31] PHP 3. trigger_error() /home/app/php/db_mysql_connect_legacy.php:9

```

And

```
[24-Mar-2016 09:59:06] EmailQueue::process - Failed to send email to '' from 'user@myapp.com' (lid: vpa_s). Errors: Array
(
    [0] => Missing destination email
)

```

Then everything else starts with

[24-Mar-2016 09:59:06]

How does the multiline handle situations like that? Whats the best way to match against multiple patterns in the same file?

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [March 24, 2016, 4:39pm UTC](https://discuss.elastic.co/t/filebeat-multiline-multiple-patterns/45335/2 "2016-03-24T16:39:32Z")

</div>

multiple multiline events of differrent kinds are not well supported yet. But the regex library has an OR operation '|' that might be helpful in your case:

You can [play with content and regex pattern](http://play.golang.org/p/ul_0SYHe4d) yourself. Just press the run button and check output. All lines starting with 'false' will start a new multiline event.

I used the pattern `pattern: '^\[.*\] PHP[[:space:]]+[[:digit:]]|^[^\[]'`. The first part `^\[.*\] PHP[[:space:]]+[[:digit:]]` captures traces (thanks to having a timestamp and having content `PHP <digit>`) and the second part (`^[^\[]`) collects all lines not beginning with '['.

---

<div class="post-metadata">

**Author:** ![moncky](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/moncky/32/6320_2.png) [@moncky](https://discuss.elastic.co/u/moncky)\
**Post date:** [March 25, 2016, 9:09am UTC](https://discuss.elastic.co/t/filebeat-multiline-multiple-patterns/45335/3 "2016-03-25T09:09:09Z")

</div>

Ahh almost prefect, that makes sense, I was using the wrong regex patterns. Turns out that \W and \d etc are not supported, that info was a little buried i the docs. but Im only getting the first line of the stack trace. Looks like I'll need to tweak the regex a bit, or use a different method on the multiline options.

---

<div class="post-metadata">

**Author:** ![vingrad](https://avatars.discourse-cdn.com/v4/letter/v/e8c25b/32.png) [@vingrad](https://discuss.elastic.co/u/vingrad)\
**Post date:** [June 22, 2016, 8:01am UTC](https://discuss.elastic.co/t/filebeat-multiline-multiple-patterns/45335/4 "2016-06-22T08:01:21Z")

</div>

Can you please post your config? I have this problem too.

---

<div class="post-metadata">

**Author:** ![Bobby](https://avatars.discourse-cdn.com/v4/letter/b/df788c/32.png) [@Bobby](https://discuss.elastic.co/u/Bobby)\
**Post date:** [June 6, 2017, 1:22pm UTC](https://discuss.elastic.co/t/filebeat-multiline-multiple-patterns/45335/5 "2017-06-06T13:22:30Z")

</div>

I'm currently running filebeat as a windows service. I haven't tried this yet, but I wonder if I defined multiple windows services, which each run an instance of filebeat with it's own .yml file. That way, each yml file could direct filebeat to a specific log with a specific multiline pattern for it.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 4, 2022, 4:17am UTC](https://discuss.elastic.co/t/filebeat-multiline-multiple-patterns/45335/6 "2022-11-04T04:17:10Z")

</div>