# Filebeat Multiline Patterns not working with Cloudfoundry

**URL:** <https://discuss.elastic.co/t/filebeat-multiline-patterns-not-working-with-cloudfoundry/279705>\
**Category:** Beats\
**Created:** [July 27, 2021, 8:47am UTC](https://discuss.elastic.co/t/filebeat-multiline-patterns-not-working-with-cloudfoundry/279705 "2021-07-27T08:47:16Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![checkmateasus](https://avatars.discourse-cdn.com/v4/letter/c/ac91a4/32.png) [@checkmateasus](https://discuss.elastic.co/u/checkmateasus)\
**Post date:** [July 27, 2021, 8:47am UTC](https://discuss.elastic.co/t/filebeat-multiline-patterns-not-working-with-cloudfoundry/279705/1 "2021-07-27T08:47:16Z")

</div>

Running Elastic Stack 7.10.2 ( Filebeat, Elastic search). The input for logs in filebeat is cloudfoundry (6.5).

The filebeat runs as a container in cloud foundry.  
We need to read multiline messages coming from cloudfoundry hosted applications. The pattern of data coming in cloud foundry is like below. Every message from the Application is between marker BEG and END.

```auto
2021-05-27T17:36:02.259+05:30 [APP/WEBR/MOB/2] [OUT] BEG 2021-07-27 11:36:02 INFO ntered into getCategoriesByCode >>>>>>>>>>> END
2021-05-27T17:36:02.260+05:30 [APP/WEBR/MOB/2] [OUT] BEG 2021-07-27 11:36:02 ERROR Invalid input. Number of categories should be between 1 and 5 java.lang.ArithmeticException: / by zero
2021-05-27T17:36:02.260+05:30 [APP/WEBR/MOB/2] [OUT] at com.xm1(CommonMessageController.java:51)
2021-05-27T17:36:02.260+05:30 [APP/WEBR/MOB/0] [OUT] at jdk.internal.reflect.GeneratedMethodAccessor58.invoke(Unknown Source)
2021-05-27T17:36:02.260+05:30 [APP/WEBR/MOB/0] [OUT] at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source) END

```

Below pattern is configured in filebeat

```auto
multiline.pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}[[:alnum:]][0-9]{2}:[0-9]{2}:[0-9]{2}.[0-9]{3}\+[0-9]{2}:[0-9]{2}[[:space:]]\[[[:alpha:]]{3}/[[:alpha:]]{4}/[[:alpha:]]{3}
/[0-9]\][[:space:]]\[OUT\][[:space:]]BEG'
 multiline.negate: true
 multiline.match: after

```

The same is not working and multilines are not getting clubbed. So we extracted the same log from cloudfoundry app to flat file and rerun the same after chaning the input to file and it worked perfectly.

Is this Cloudfoundry issue ? How we can resolve it.

 ![cflog](https://us1.discourse-cdn.com/elastic/original/3X/4/5/455cdec7f1b992f227f5f40259dc6918d0adc34a.jpeg)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 24, 2021, 8:47am UTC](https://discuss.elastic.co/t/filebeat-multiline-patterns-not-working-with-cloudfoundry/279705/2 "2021-08-24T08:47:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.