# Filebeat Multiline Pattern not working on Production servers **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [August 24, 2021, 6:41pm UTC](https://discuss.elastic.co/t/filebeat-multiline-pattern-not-working-on-production-servers/282398 "2021-08-24T18:41:32Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![Pavani\_Reddy](https://avatars.discourse-cdn.com/v4/letter/p/5f9b8f/32.png) [@Pavani\_Reddy](https://discuss.elastic.co/u/Pavani_Reddy)\ **Post date:** [August 24, 2021, 6:41pm UTC](https://discuss.elastic.co/t/filebeat-multiline-pattern-not-working-on-production-servers/282398/1 "2021-08-24T18:41:33Z")
Hi Team, I am using multiline.pattern in filebeat for parsing logs. I am able parse the logs correctly on local lab servers, but when implemented the same on prod servers , multiple logs gets indexed as one event to elasticsearch for some source files,remaining source file logs are parsing correctly I have given log path in filebeat as - /opt/IBM/tivoli/netcool/PROD/cyientprobes/stream/DMS100/\*.stream and multiline.pattern: ' ^\s{0,2}\d+\s\w+\s+\d+|^[\*]+\s{0,2}\d{2}\s+\w+\s+\d+\s\w+' log messages in one event indexed in kibana is as following: ''' 59 TELN120 2934 INFO Telnet Dis-Connection. ``` Node Name: CM Node Number: 0 Remote Node Address: 10.85.56.2 ``` . 59 PM 981 2245 INFO IDT 44 ``` TMC 2 - IsTb: Data Link up, PPS Link down ``` . - 59 PM 128 2836 TBL ISTB IDT 48 ''' Please, someone help me regarding this issue. Thanks in advance Pavani ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 21, 2021, 8:41pm UTC](https://discuss.elastic.co/t/filebeat-multiline-pattern-not-working-on-production-servers/282398/2 "2021-09-21T20:41:41Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.