# Filebeat multiline patern loglevel match

**URL:** <https://discuss.elastic.co/t/filebeat-multiline-patern-loglevel-match/235362>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [June 2, 2020, 3:07pm UTC](https://discuss.elastic.co/t/filebeat-multiline-patern-loglevel-match/235362 "2020-06-02T15:07:30Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Orest\_Gulman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/orest_gulman/32/46463_2.png) [@Orest\_Gulman](https://discuss.elastic.co/u/Orest_Gulman)\
**Post date:** [June 2, 2020, 3:07pm UTC](https://discuss.elastic.co/t/filebeat-multiline-patern-loglevel-match/235362/1 "2020-06-02T15:07:31Z")

</div>

The log has the following view:

```
[WARNING]	[HOSTNAME]	[Servicename.Web.Node2]	[https://google.com/application/WebModules/AdminTools/UsersSessionInfo/UsersSessionInfo.aspx]	[12/26/2019 15:34:27.569]	[DOMAIN\USER]	[CLUSTERING]	[Cluster:721:GetOtherSessions]	Error while trying to retrieve sessions information from node 'hostname'. Reason: System.ServiceModel.EndpointNotFoundException: There was no endpoint listening at https://google.com/application/WebServices/WCF/Clustering/ClusteringService.svc that could accept the message. This is often caused by an incorrect address or SOAP action. See InnerException, if present, for more details. ---> System.Net.WebException: Unable to connect to the remote server ---> System.Net.Sockets.SocketException: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond 192.168.0.1:443
   at System.Net.Sockets.Socket.DoConnect(EndPoint endPointSnapshot, SocketAddress socketAddress)
   at System.Net.ServicePoint.ConnectSocketInternal(Boolean connectFailure, Socket s4, Socket s6, Socket& socket, IPAddress& address, ConnectSocketState state, IAsyncResult asyncResult, Exception& exception)
   --- End of inner exception stack trace ---
   at System.Net.HttpWebRequest.GetRequestStream(TransportContext& context)
   at System.Net.HttpWebRequest.GetRequestStream()
   at System.ServiceModel.Channels.HttpOutput.WebRequestHttpOutput.GetOutputStream()
   --- End of inner exception stack trace ---

Server stack trace: 
   at System.ServiceModel.Channels.HttpOutput.WebRequestHttpOutput.GetOutputStream()
   at System.ServiceModel.Channels.HttpOutput.Send(TimeSpan timeout)
   at System.ServiceModel.Channels.HttpChannelFactory`1.HttpRequestChannel.HttpChannelRequest.SendRequest(Message message, TimeSpan timeout)
   at System.ServiceModel.Channels.RequestChannel.Request(Message message, TimeSpan timeout)
   at System.ServiceModel.Channels.SecurityChannelFactory`1.SecurityRequestChannel.Request(Message message, TimeSpan timeout)
   at System.ServiceModel.Dispatcher.RequestChannelBinder.Request(Message message, TimeSpan timeout)
   at System.ServiceModel.Channels.ServiceChannel.Call(String action, Boolean oneway, ProxyOperationRuntime operation, Object[] ins, Object[] outs, TimeSpan timeout)
   at System.ServiceModel.Channels.ServiceChannelProxy.InvokeService(IMethodCallMessage methodCall, ProxyOperationRuntime operation)
   at System.ServiceModel.Channels.ServiceChannelProxy.Invoke(IMessage message)

Exception rethrown at [0]: 
   at System.Runtime.Remoting.Proxies.RealProxy.HandleReturnMessage(IMessage reqMsg, IMessage retMsg)
   at System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke(MessageData& msgData, Int32 type)
   at Selerant.ApplicationBlocks.Clustering.Service.IClusteringService.GetSessions()
   at Selerant.ApplicationBlocks.Clustering.Service.ClusteringServiceClient.GetSessions()
   at Selerant.ApplicationBlocks.Clustering.Cluster.GetOtherSessions(BaseNode server)	[]	[26]
[ERROR]	[HOSTNAME]	[Servicename.Web.Node2]	[https://google.com/application/WebModules/AdminTools/UsersSessionInfo/UsersSessionInfo.aspx]	[12/26/2019 15:34:27.569]	[DOMAIN\USER]	[]	[DevExBasePage:1109:DevExPage_Error]	Unmanaged exception. The following exception was thrown: System.NullReferenceException: Object reference not set to an instance of an object.
   at Selerant.DevEx.WebModules.AdminTools.UsersSessionInfo.UsersSessionCtrl.FillSessionsInfosGrid()
   at Selerant.DevEx.WebModules.AdminTools.UsersSessionInfo.UsersSessionCtrl.FillGrids()
   at System.Web.UI.Control.LoadRecursive()
   at System.Web.UI.Control.LoadRecursive()
   at System.Web.UI.Control.LoadRecursive()
   at System.Web.UI.Control.LoadRecursive()
   at System.Web.UI.Control.LoadRecursive()
   at System.Web.UI.Control.LoadRecursive()
   at System.Web.UI.Control.LoadRecursive()
   at System.Web.UI.Control.LoadRecursive()
   at System.Web.UI.Control.LoadRecursive()
   at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)	[]	[26]

```

Each log entry starts with log level such us [WARNING] or [ERROR], I need to strictly specify it in filebeat configuration for matching each log entries.  
The question is, how to specify it in multiline.pattern?

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [June 2, 2020, 3:56pm UTC](https://discuss.elastic.co/t/filebeat-multiline-patern-loglevel-match/235362/2 "2020-06-02T15:56:54Z")

</div>

`multiline.pattern` expects a regex. If your lines start with either `[WARNING]` or `[ERROR]` I suggest you go with the following pattern:

```auto
multiline.pattern: ^(\[ERROR\]|\[WARNING\])

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 30, 2020, 3:56pm UTC](https://discuss.elastic.co/t/filebeat-multiline-patern-loglevel-match/235362/3 "2020-06-30T15:56:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.