# Filebeat multiline not working **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [October 13, 2017, 10:02am UTC](https://discuss.elastic.co/t/filebeat-multiline-not-working/103870 "2017-10-13T10:02:53Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![VidyVideni](https://avatars.discourse-cdn.com/v4/letter/v/e5b9ba/32.png) [@VidyVideni](https://discuss.elastic.co/u/VidyVideni)\ **Post date:** [October 13, 2017, 10:02am UTC](https://discuss.elastic.co/t/filebeat-multiline-not-working/103870/1 "2017-10-13T10:02:53Z")
Nginx test error log ```auto [2017/10/13 16:17:49] [error] 21169#21169: *113356 FastCGI sent in stderr: "PHP message: PHP Fatal error: Class 'Elasticsearch\ClientBuilder' not found in /home/work/website/cdt0-webapp.example.com/components/search/ES.php on line 18 PHP message: PHP Stack trace: PHP message: PHP 1. {main}() /home/work/website/cdt0-webapp.example.com/web/index.php:0 PHP message: PHP 2. yii\base\Application->run() /home/work/website/cdt0-webapp.example.com/web/index.php:39 PHP message: PHP 3. yii\web\Application->handleRequest() /home/work/website/cdt0-webapp.example.com/vendor/yiisoft/yii2/base/Application.php:380 PHP message: PHP 4. yii\base\Module->runAction() /home/work/website/cdt0-webapp.example.com/vendor/yiisoft/yii2/web/Application.php:102 PHP message: PHP 5. yii\base\Controller->runAction() /home/work/website/cdt0-webapp.example.com/vendor/yiisoft/yii2/base/Module.php:523 PHP message: PHP 6. yii\base\InlineAction->runWithParams() /home/work/website/cdt0-webapp.example.com/vendor/yiisoft/yii2/base/Controller.php:156 PHP message: PHP 7. call_user_func_array:{/home/work/website/cdt0-webapp.example.com/vendor/yiisoft/yii2/base/InlineAction.php:57}() /home/work/website/cdt0-webapp.example.com/vendor/yiisoft/yii2/base/InlineAction.php:57 PHP message: PHP 8. app\modules\trades\controllers\ListController->actionIndex() /home/work/website/cdt0-webapp.example.com/vendor/yiisoft/yii2/base/InlineAction.php:57 PHP message: PHP 9. app\components\search\Search::getAggs() /home/work/website/cdt0-webapp.example.com/modules/trades/controllers/ListController.php:151 PHP message: PHP 10. app\components\search\ES::getClient() /home/work/website/cdt0-webapp.example.com/components/search/Search.php:274" while reading response header from upstream, client: 127.0.0.1, server: cdt1-passport.example.com, request: "GET /game/huoyingrenzhe-2379-20-1 HTTP/1.1", upstream: "fastcgi://127.0.0.1:9000", host: "cdt0-webapp.example.com", referrer: "http://cdt0-webapp.example.com/" ``` Filebeat config ```auto filebeat.prospectors: - input_type: log paths: - /tmp/test.log multiline.pattern: '^\[' multiline.negate: true multiline.match: after output.logstash: hosts: ["localhost:5043"] ``` Execute filebeat , I get following result, apparently these lines are not merged. ```auto 017/10/13 10:01:03.752015 log.go:91: INFO Harvester started for file: /tmp/test.log 2017/10/13 10:01:08.752489 client.go:214: DBG Publish: { "@timestamp": "2017-10-13T10:01:03.752Z", "beat": { "hostname": "tsy01", "name": "tsy01", "version": "5.6.3" }, "input_type": "log", "message": "2017/10/13 16:17:49 [error] 21169#21169: *113356 FastCGI sent in stderr: \"PHP message: PHP Fatal error: Class 'Elasticsearch\\ClientBuilder' not found in /home/work/website/cdt0-webapp.example.com/components/search/ES.php on line 18", "offset": 233, "source": "/tmp/test.log", "type": "log" } 2017/10/13 10:01:08.752632 client.go:214: DBG Publish: { "@timestamp": "2017-10-13T10:01:03.752Z", "beat": { "hostname": "tsy01", "name": "tsy01", "version": "5.6.3" }, "input_type": "log", "message": "PHP message: PHP Stack trace:", "offset": 263, "source": "/tmp/test.log", "type": "log" } ``` ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [October 13, 2017, 1:25pm UTC](https://discuss.elastic.co/t/filebeat-multiline-not-working/103870/2 "2017-10-13T13:25:32Z")
The multiline settings must be added to the prospector reading the log files. Seeing just a small snippet of your config, I can not tell if you've applied the settings in the correct namespace. ---
**Author:** ![VidyVideni](https://avatars.discourse-cdn.com/v4/letter/v/e5b9ba/32.png) [@VidyVideni](https://discuss.elastic.co/u/VidyVideni)\ **Post date:** [October 16, 2017, 2:07am UTC](https://discuss.elastic.co/t/filebeat-multiline-not-working/103870/3 "2017-10-16T02:07:02Z")
@steffens, thanks , I updated the filebeat config , please check that again. ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [October 16, 2017, 2:41pm UTC](https://discuss.elastic.co/t/filebeat-multiline-not-working/103870/4 "2017-10-16T14:41:41Z")
Checking the formatting of your filebeat configuration I wonder, does filebeat event startup? Doesn't look like valid YAML yo me, as all indentation is kind of out of place. Check [Config file format docs](https://www.elastic.co/guide/en/beats/libbeat/current/config-file-format.html). ---
**Author:** ![VidyVideni](https://avatars.discourse-cdn.com/v4/letter/v/e5b9ba/32.png) [@VidyVideni](https://discuss.elastic.co/u/VidyVideni)\ **Post date:** [October 16, 2017, 3:52pm UTC](https://discuss.elastic.co/t/filebeat-multiline-not-working/103870/5 "2017-10-16T15:52:28Z")
Hi, the format works , you can see the events published from filebeat log I posted there, the indentation might be wrong, I just removed all irrelevant comments,but it shows correct structure,the regular expression pattern is supposed to match the log, ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [October 18, 2017, 9:31am UTC](https://discuss.elastic.co/t/filebeat-multiline-not-working/103870/6 "2017-10-18T09:31:22Z")
copy pasting the filebeat config in [http://www.yamllint.com](http://www.yamllint.com), it complaints about the YAML being incorrect. For multiline to work the indentation should be more like: ```auto filebeat.prospectors: - input_type: log paths: - /tmp/test.log multiline.pattern: '^\[' multiline.negate: true multiline.match: after output.logstash: hosts: ["localhost:5043"] ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 15, 2017, 9:31am UTC](https://discuss.elastic.co/t/filebeat-multiline-not-working/103870/7 "2017-11-15T09:31:45Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.