# Filebeat-multiline not working
**URL:** https://discuss.elastic.co/t/filebeat-multiline-not-working/197378
**Category:** Beats
**Tags:** filebeat
**Created:** [August 29, 2019, 4:08pm UTC](https://discuss.elastic.co/t/filebeat-multiline-not-working/197378 "2019-08-29T16:08:19Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@deemanu](https://discuss.elastic.co/u/deemanu)
#### Post date: [August 29, 2019, 4:08pm UTC](https://discuss.elastic.co/t/filebeat-multiline-not-working/197378/1 "2019-08-29T16:08:19Z")
Hello ,
I have below logs to parse .No idea if timestamp in grok is the one which is failing or multiline conf in filebeat .please help
Timestamp: 8/19/2019 4:17:15 PM
Message: affd Response | 130313 | GetUsageDetails | 0.1206999 Seconds | Uri | [https://bdsdsm-bsdfd-dds-1.pdddd.dcddd.idddt.bddd.ca/Edssfe/AdJSON/billfsfsfng/gdsdfs](https://bdsdsm-bsdfd-dds-1.pdddd.dcddd.idddt.bddd.ca/Edssfe/AdJSON/billfsfsfng/gdsdfs) | ResponsePhrase | OK | Action | Awewddc/billing/getUsageDewee | Code | 0000000000 | RequestId | 130313
Timestamp: 8/19/2019 4:17:16 PM
Message: AMdddf Response | 130316 | GetNagDetails | 0.1039091 Seconds | Uri | [https://bwfeffm-bfdfd-tls-1.prod.dfgf.int.wwdwf.ca/ECafdfefe/Adsfff/accountInfo/getNagDetails](https://bwfeffm-bfdfd-tls-1.prod.dfgf.int.wwdwf.ca/ECafdfefe/Adsfff/accountInfo/getNagDetails) | ResponsePhrase | OK | Action | dsdsf/accountInfo/getNagDetails | Code | 0000000000 | RequestId | 130316
Timestamp: 8/19/2019 4:17:16 PM
Grok
input {
beats {
port =\> 5044
}
}
filter {
grok {
patterns\_dir =\> ["C:\Users\manu.manu\Desktop\ELK\Patterns"]
match =\> { "message" =\> "%{Time:tym} \n %{MSG:Message}\s\*| %{N:RequestedID} %{GREEDYDATA} %{WORD:GetMethod} | %{N:ResponseTime} %{GREEDYDATA} %{URI:URIRequested} %{GREEDYDATA} %{WORD:Responsephrase} %{GREEDYDATA} %{ACC:Action} %{GREEDYDATA}" }
}
}
output {
elasticsearch {
hosts =\> ["[http://localhost:9200](http://localhost:9200)"]
index =\> "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
#user =\> "elastic"
#password =\> "changeme"
}
}
Filebeat multiline config ---------------------------------------------------
# The regexp Pattern that has to be matched. The example pattern matches all lines starting with [
multiline.pattern: '^T'
# Defines if the pattern set under pattern should be negated or not. Default is false.
multiline.negate: true
# Match can be set to "after" or "before". It is used to define if lines should be append to a pattern
# that was (not) matched before or after or as long as a pattern is not matched based on negate.
# Note: After is the equivalent to previous and before is the equivalent to to next in Logstash
multiline.match: before
---
### Author:  [@kumarabhi](https://discuss.elastic.co/u/kumarabhi)
#### Post date: [August 29, 2019, 10:49pm UTC](https://discuss.elastic.co/t/filebeat-multiline-not-working/197378/2 "2019-08-29T22:49:44Z")
Please check [https://www.elastic.co/guide/en/beats/filebeat/current/\_examples\_of\_multiline\_configuration.html](https://www.elastic.co/guide/en/beats/filebeat/current/_examples_of_multiline_configuration.html)
Also, verify your multiline pattern on [https://play.golang.org](https://play.golang.org)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 26, 2019, 10:51pm UTC](https://discuss.elastic.co/t/filebeat-multiline-not-working/197378/3 "2019-09-26T22:51:36Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.