# FileBeat multiline parser fails with '^#\[0-9\]'

**URL:** <https://discuss.elastic.co/t/filebeat-multiline-parser-fails-with-0-9/97012>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [August 14, 2017, 6:33pm UTC](https://discuss.elastic.co/t/filebeat-multiline-parser-fails-with-0-9/97012 "2017-08-14T18:33:03Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ianseyer](https://avatars.discourse-cdn.com/v4/letter/i/edb3f5/32.png) [@ianseyer](https://discuss.elastic.co/u/ianseyer)\
**Post date:** [August 14, 2017, 6:33pm UTC](https://discuss.elastic.co/t/filebeat-multiline-parser-fails-with-0-9/97012/1 "2017-08-14T18:33:03Z")

</div>

Hi.

I am attempting to use the multiline parser for Filebeat to chunk my Laravel log into useful segments. Laravel logs spew a multi-line stacktrace by prepending each line with #1, #2, ..., #n. Therefore, I am attempting to capture this by using the `multiline.pattern` feature.

Here is my attempted pattern:  
`multiline.pattern: '^#'`, `multiline.pattern: '^#[0-9]'`, `multiline.pattern: ^#`

the IRC #yaml gods have agreed that all of these are valid.

However, running filebeat marks my config as valid, but attempting to start it puts this in the logs:

```auto
2017-08-14T18:21:02Z CRIT Exiting: error loading states for prospector 795983330737221375: missing required field accessing 'filebeat.prospectors.0.multiline.match' (source:'/etc/filebeat/filebeat.yml')

```

I have confirmed that this is the root of the error, as changing to the default (or commenting the line entirely) works fine.

---

<div class="post-metadata">

**Author:** ![ianseyer](https://avatars.discourse-cdn.com/v4/letter/i/edb3f5/32.png) [@ianseyer](https://discuss.elastic.co/u/ianseyer)\
**Post date:** [August 14, 2017, 6:35pm UTC](https://discuss.elastic.co/t/filebeat-multiline-parser-fails-with-0-9/97012/2 "2017-08-14T18:35:22Z")

</div>

Nevermind. Misread the error message; did not realize `multiline.match` must be set.

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [August 15, 2017, 8:50pm UTC](https://discuss.elastic.co/t/filebeat-multiline-parser-fails-with-0-9/97012/3 "2017-08-15T20:50:59Z")

</div>


