# FIlebeat multiline pattern

**URL:** <https://discuss.elastic.co/t/filebeat-multiline-pattern/112868>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [December 21, 2017, 5:50pm UTC](https://discuss.elastic.co/t/filebeat-multiline-pattern/112868 "2017-12-21T17:50:05Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![akashP](https://avatars.discourse-cdn.com/v4/letter/a/ecb155/32.png) [@akashP](https://discuss.elastic.co/u/akashP)\
**Post date:** [December 21, 2017, 5:50pm UTC](https://discuss.elastic.co/t/filebeat-multiline-pattern/112868/1 "2017-12-21T17:50:05Z")

</div>

I have log file with multiline events:

```
    4773 [Access(63)-21-02.00-dxf_laboratories] ERROR 2017-12-14T17:29:38.946 com.utils.CommonUtils - event=Laboratory - dv_laboratories recordKey=nullTest || errorMessage=ERROR_TRANSMITTING  
javax.jms.JMSException: Could not create Transport. Reason: java.lang.NullPointerException
	at org.apache.activemq.util.JMSExceptionSupport.create(JMSExceptionSupport.java:36)
	at org.apache.activemq.ActiveMQSslConnectionFactory.createTransport(ActiveMQSslConnectionFactory.java:120)
	at org.apache.activemq.ActiveMQConnectionFactory.createActiveMQConnection(ActiveMQConnectionFactory.java:332)
	at org.apache.activemq.ActiveMQConnectionFactory.createActiveMQConnection(ActiveMQConnectionFactory.java:305)
	at org.apache.activemq.ActiveMQConnectionFactory.createConnection(ActiveMQConnectionFactory.java:245)
	at com.utils.CommonUtils.getProducer(CommonUtils.java:127)
	at com.utils.CommonUtils.sendBatch(CommonUtils.java:94)
	at com.storedprocedures.Labs.send(Labs.java:91)
	at com.storedprocedures.Labs.process(Labs.java:72)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
	at java.lang.reflect.Method.invoke(Unknown Source)
	at com.davita.cwow.utils.StoredProcedureUtils.doCall(StoredProcedureUtils.java:123)
	at com.denodo.vdb.engine.storedprocedure.StoredProcedureWorker.run(Unknown Source)
	at com.denodo.vdb.engine.thread.g.a(Unknown Source)
	at com.denodo.vdb.engine.thread.ReusableThread.run(Unknown Source)
Caused by: java.lang.NullPointerException
	at org.apache.activemq.ActiveMQSslConnectionFactory.createTrustManager(ActiveMQSslConnectionFactory.java:133)
	at org.apache.activemq.ActiveMQSslConnectionFactory.createTransport(ActiveMQSslConnectionFactory.java:113)
	... 15 more

```

everything else start with this pattern "%-4r [%t] %-5p %d{yyyy-MM-dd'T'HH:mm:ss.SSS} %c %x - %m %n"

How does the multiline handle situations like that? Whats the best way to match against multiple patterns in the same file?

---

<div class="post-metadata">

**Author:** ![akashP](https://avatars.discourse-cdn.com/v4/letter/a/ecb155/32.png) [@akashP](https://discuss.elastic.co/u/akashP)\
**Post date:** [December 26, 2017, 7:09pm UTC](https://discuss.elastic.co/t/filebeat-multiline-pattern/112868/2 "2017-12-26T19:09:49Z")

</div>

Figured it out!

Enabled these properties in yml file:  
multiline.pattern: Exception:+|at +|Caused by:+|more  
multiline.negate: false  
multiline.match: after

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 23, 2018, 7:10pm UTC](https://discuss.elastic.co/t/filebeat-multiline-pattern/112868/3 "2018-01-23T19:10:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.