# Filebeat Multiline problem

**URL:** <https://discuss.elastic.co/t/filebeat-multiline-problem/49178>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 4, 2016, 1:20pm UTC](https://discuss.elastic.co/t/filebeat-multiline-problem/49178 "2016-05-04T13:20:45Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![sunilmchaudhari](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sunilmchaudhari/32/9475_2.png) [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\
**Post date:** [May 4, 2016, 1:20pm UTC](https://discuss.elastic.co/t/filebeat-multiline-problem/49178/1 "2016-05-04T13:20:45Z")

</div>

Hi,  
I am facing problem in multiline handling in Fileebeat.

below is the Error statcktrace:

```
2016-05-04 16:14:04,376 [http-bio-8443-exec-16] [username 87527E1A8A32B2F0CE4955E6598CC98D] ERROR com.tieto.its.sb.service.AbstractApplicationService - Exception Trace :: 
com.tieto.its.sc.exceptions.SystemException: null
	at com.tieto.its.sc.exceptions.ExceptionHandler.throwSystemException(ExceptionHandler.java:106)
	at com.tieto.its.rss.integration.impl.RssApplicationIntegration.handleRuntimeException(RssApplicationIntegration.java:78)
	at com.tieto.its.rss.integration.impl.RssApplicationIntegration.handleRestException(RssApplicationIntegration.java:52)
	at com.tieto.its.sc.restclient.AbstractRestClient.invoke(AbstractRestClient.java:90)
	at com.tieto.its.rss.integration.impl.VoucherSaleIntegration.retrievedistributedVoucherInfo(VoucherSaleIntegration.java:175)

```

FB configuration:

```
 multiline:
       pattern: "^com.|^[[:space:]]+at"
       negate: false
       match: after

```

Still its spanning across multiple rows in Kibana. Can anybody suggest correct pattern for this? I am not good in regex. ☹

br,  
Sunil

---

<div class="post-metadata">

**Author:** ![gcherneski](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gcherneski/32/9382_2.png) [@gcherneski](https://discuss.elastic.co/u/gcherneski)\
**Post date:** [May 4, 2016, 2:27pm UTC](https://discuss.elastic.co/t/filebeat-multiline-problem/49178/2 "2016-05-04T14:27:15Z")

</div>

I had a similar timestamp and solved it, with the help from steffens with the folowing:  
**pattern: '(^20[0-9]{2}(-[0-9]{2}){2} [0-9]{2}(:[0-9]{2}){2})'**  
and setting:  
**negate: true**  
**match: after**  
which, per [https://www.elastic.co/guide/en/beats/filebeat/1.2/configuration-filebeat-options.html](https://www.elastic.co/guide/en/beats/filebeat/1.2/configuration-filebeat-options.html)

"Consecutive lines that don’t match the pattern are appended to the previous line that does match."

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 9:52pm UTC](https://discuss.elastic.co/t/filebeat-multiline-problem/49178/3 "2017-07-05T21:52:23Z")

</div>