# Filebeat multiline pattern with linefeed

**URL:** <https://discuss.elastic.co/t/filebeat-multiline-pattern-with-linefeed/193266>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [August 1, 2019, 7:11am UTC](https://discuss.elastic.co/t/filebeat-multiline-pattern-with-linefeed/193266 "2019-08-01T07:11:10Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![thps](https://avatars.discourse-cdn.com/v4/letter/t/f19dbf/32.png) [@thps](https://discuss.elastic.co/u/thps)\
**Post date:** [August 1, 2019, 7:11am UTC](https://discuss.elastic.co/t/filebeat-multiline-pattern-with-linefeed/193266/1 "2019-08-01T07:11:11Z")

</div>

Dear all,

i try to match a multiline java - event in Filebeat via multiline pattern. In general, this is still working, but i´m not able to parse empty lines in this event. The String looks like this:

```
BMC:SR:2019-08-01 07:37:00:ERROR (TaskScheduler:run) - Error checking system schedules: 
com.hof.util.ActionErrorsException: DBAction constructor exception
com.hof.util.ActionErrorsException: DBAction constructor exception
    at com.hof.util.DBAction.<init>(DBAction.java:378)
    at com.hof.util.DBAction.<init>(DBAction.java:465)
    at com.hof.util.DBAction.<init>(DBAction.java:420)
    at com.hof.mi.servlet.TaskScheduler.A(TaskScheduler.java:335)
    at com.hof.mi.servlet.TaskScheduler.run(TaskScheduler.java:487)
    at java.util.TimerThread.mainLoop(Unknown Source)
    at java.util.TimerThread.run(Unknown Source)
Caused by: 

    at oracle.jdbc.driver.T4CTTIoer.processError(T4CTTIoer.java:445)
    at oracle.jdbc.driver.T4CTTIoer.processError(T4CTTIoer.java:389)
    at oracle.jdbc.driver.T4CTTIoer.processError(T4CTTIoer.java:382)
    at oracle.jdbc.driver.T4CTTIfun.processError(T4CTTIfun.java:600)
    at oracle.jdbc.driver.T4CTTIoauthenticate.processError(T4CTTIoauthenticate.java:445)
    at oracle.jdbc.driver.T4CTTIfun.receive(T4CTTIfun.java:450)
    at oracle.jdbc.driver.T4CTTIfun.doRPC(T4CTTIfun.java:192)
    at oracle.jdbc.driver.T4CTTIoauthenticate.doOAUTH(T4CTTIoauthenticate.java:380)
    at oracle.jdbc.driver.T4CTTIoauthenticate.doOAUTH(T4CTTIoauthenticate.java:760)
    at oracle.jdbc.driver.T4CConnection.logon(T4CConnection.java:401)
    at oracle.jdbc.driver.PhysicalConnection.<init>(PhysicalConnection.java:546)
    at oracle.jdbc.driver.T4CConnection.<init>(T4CConnection.java:236)
    at oracle.jdbc.driver.T4CDriverExtension.getConnection(T4CDriverExtension.java:32)
    at oracle.jdbc.driver.OracleDriver.connect(OracleDriver.java:521)
    at com.hof.pool.JDBCConnection.openConnection(JDBCConnection.java:179)
    at com.hof.pool.DBConnection.authenticateAndOpenConnection(DBConnection.java:127)
    at com.hof.pool.DBConnectionPool.A(DBConnectionPool.java:1211)
    at com.hof.pool.DBConnectionPool.checkOutConnection(DBConnectionPool.java:1347)
    at com.hof.pool.DBConnectionManager.getConnection(DBConnectionManager.java:309)
    at com.hof.util.DBAction.<init>(DBAction.java:352)
    ... 6 more

```

and my RegEx is:  
'^[[:space:]]|^Caused by:|^java|^org|^com'

i also tried  
'^[[:space:]]|^Caused by:|^java|^org|^com|^$'

but this doent work at all.

The shown character in this logevent (:set list in vi) ist "$".

Are there any ideas how to fix this?

Thanks a lot

---

<div class="post-metadata">

**Author:** ![justkind](https://avatars.discourse-cdn.com/v4/letter/j/919ad9/32.png) [@justkind](https://discuss.elastic.co/u/justkind)\
**Post date:** [August 1, 2019, 4:14pm UTC](https://discuss.elastic.co/t/filebeat-multiline-pattern-with-linefeed/193266/2 "2019-08-01T16:14:01Z")

</div>

Hmm, can you share your filebeat.yml configuration? Specifically the multiline parts.  
According to the Go playground, your regex should work fine, with the '^$' capturing the empty line:

[https://play.golang.org/p/OeC1cMuQNQe](https://play.golang.org/p/OeC1cMuQNQe)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 29, 2019, 4:14pm UTC](https://discuss.elastic.co/t/filebeat-multiline-pattern-with-linefeed/193266/3 "2019-08-29T16:14:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.