# Filebeat multiline pattern for PHP stack trace

**URL:** <https://discuss.elastic.co/t/filebeat-multiline-pattern-for-php-stack-trace/281003>\
**Category:** Beats\
**Tags:** docker, filebeat\
**Created:** [August 11, 2021, 7:14am UTC](https://discuss.elastic.co/t/filebeat-multiline-pattern-for-php-stack-trace/281003 "2021-08-11T07:14:47Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Thessis940](https://avatars.discourse-cdn.com/v4/letter/t/c68b51/32.png) [@Thessis940](https://discuss.elastic.co/u/Thessis940)\
**Post date:** [August 11, 2021, 7:14am UTC](https://discuss.elastic.co/t/filebeat-multiline-pattern-for-php-stack-trace/281003/1 "2021-08-11T07:14:47Z")

</div>

I am trying to import the PHP FPM logs into an ELK stack. For this I use the filebeat to read the files. Before sending this data to logstash, the multiline log entries should be merged.

For this I built this filebeat configuration:

```auto
filebeat.inputs:

  # Each - is an input. Most options can be set at the input level, so
  # you can use different inputs for various configurations.
  # Below are the input specific configurations.

  - type: filestream

    # Change to true to enable this input configuration.
    enabled: true

    # Paths that should be crawled and fetched. Glob based paths.
    paths:
      - '/var/log/app/fpm/*.log'

    multiline.type: pattern
    multiline.pattern: '^\[\d{2}-\w{3}-\d{4} \d{2}:\d{2}:\d{2} [\w/]*\] PHP\s*at.*'
    multiline.negate: false
    multiline.match: after

    processors:
      - add_fields:
          fields.docker.service: "fpm"

```

But as you can see in the ruby debug output from logstash, the messages were not merged:

```auto
{
        "@timestamp" => 2021-08-10T13:54:10.149Z,
        "agent" => {
                 "version" => "7.13.4",
                "hostname" => "3cb76d7d4c7d",
                      "id" => "61dec25e-12ec-4a65-9f1f-ec72a5aa83ee",
            "ephemeral_id" => "631db0d8-60ad-4625-891c-3da09cb0a442",
                    "type" => "filebeat"
        },
             "input" => {
            "type" => "filestream"
        },
               "log" => {
            "offset" => 344,
              "file" => {
                "path" => "/var/log/app/fpm/error.log"
            }
        },
              "tags" => [
            [0] "beats_input_codec_plain_applied",
            [1] "_grokparsefailure"
        ],
            "fields" => {
            "docker" => {
                "service" => "fpm"
            }
        },
          "@version" => "1",
           "message" => "[17-Jun-2021 13:07:56 Europe/Berlin] PHP [WARN] (/var/www/html/Renderer/RendererTranslator.php:92) - unable to translate type integer. It is not a string (/url.php)",
               "ecs" => {
            "version" => "1.8.0"
        }
    }
    {
      "input" => {
            "type" => "filestream"
        },
            "module" => "PHP IES\\ServerException",
               "ecs" => {
            "version" => "1.8.0"
        },
          "@version" => "1",
               "log" => {
            "offset" => 73,
              "file" => {
                "path" => "/var/log/ies/fpm/error.log"
            }
        },
        "@timestamp" => 2021-06-17T11:10:41.000Z,
             "agent" => {
                 "version" => "7.13.4",
                "hostname" => "3cb76d7d4c7d",
                      "id" => "61dec25e-12ec-4a65-9f1f-ec72a5aa83ee",
            "ephemeral_id" => "631db0d8-60ad-4625-891c-3da09cb0a442",
                    "type" => "filebeat"
        },
              "tags" => [
            [0] "beats_input_codec_plain_applied"
        ],
            "fields" => {
            "docker" => {
                "service" => "fpm"
            }
        },
           "message" => "core.login"
    }
    {
        "@timestamp" => 2021-08-10T13:54:10.149Z,
             "agent" => {
                 "version" => "7.13.4",
                "hostname" => "3cb76d7d4c7d",
                      "id" => "61dec25e-12ec-4a65-9f1f-ec72a5aa83ee",
            "ephemeral_id" => "631db0d8-60ad-4625-891c-3da09cb0a442",
                    "type" => "filebeat"
        },
               "ecs" => {
            "version" => "1.8.0"
        },
             "input" => {
            "type" => "filestream"
        },
              "tags" => [
            [0] "beats_input_codec_plain_applied",
            [1] "_grokparsefailure"
        ],
            "fields" => {
            "docker" => {
                "service" => "fpm"
            }
        },
          "@version" => "1",
           "message" => "[17-Jun-2021 13:10:41 Europe/Berlin] PHP at App\\Module\\ComponentModel\\ComponentModel->doPhase(/var/www/html/Component/Container.php:348)",
               "log" => {
            "offset" => 204,
              "file" => {
                "path" => "/var/log/app/fpm/error.log"
            }
        }
    }

```

I tested the regular expression with Rubular and it matches the stack trace messages. Also the debug output of Filebeat shows no errors nor warning.

What am I doing wrong here?

---

<div class="post-metadata">

**Author:** ![Thessis940](https://avatars.discourse-cdn.com/v4/letter/t/c68b51/32.png) [@Thessis940](https://discuss.elastic.co/u/Thessis940)\
**Post date:** [August 19, 2021, 8:38am UTC](https://discuss.elastic.co/t/filebeat-multiline-pattern-for-php-stack-trace/281003/2 "2021-08-19T08:38:06Z")

</div>

I was able to solve the problem myself in the meantime. My log files are now written in JSON format so that no more multi-line messages are written.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 16, 2021, 10:38am UTC](https://discuss.elastic.co/t/filebeat-multiline-pattern-for-php-stack-trace/281003/3 "2021-09-16T10:38:32Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.