# Filebeat multiline question **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [April 5, 2016, 9:45pm UTC](https://discuss.elastic.co/t/filebeat-multiline-question/46455 "2016-04-05T21:45:28Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![mregmi](https://avatars.discourse-cdn.com/v4/letter/m/2bfe46/32.png) [@mregmi](https://discuss.elastic.co/u/mregmi)\ **Post date:** [April 5, 2016, 9:45pm UTC](https://discuss.elastic.co/t/filebeat-multiline-question/46455/1 "2016-04-05T21:45:28Z")
My application maintains its state by persisting some info on a file within an interval of time. This file is not more than 10 lines at a time. The format of the data that's inside the file would be something like this, INFO=Hello World DATE=Feb 10 2016 06:12:34 APPLICATION=TESTAPP USER=BLAH It seems like filebeat is only able to tail the file and read line by line which is not what I want. I want to parse these lines as a single JSON document and send to elastic. Is there anyway to do so in filebeat ? Thank you for any input.... ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [April 6, 2016, 6:01am UTC](https://discuss.elastic.co/t/filebeat-multiline-question/46455/2 "2016-04-06T06:01:22Z")
Filebeat has a multiline option for merging messages spread over multiple lines. Does a logical message always begin with an "INFO=" line, or how do you recognize the start of a message? Filebeat won't able to parse the key/value pairs in the resulting message into JSON. You need Logstash for that. ---
**Author:** ![mregmi](https://avatars.discourse-cdn.com/v4/letter/m/2bfe46/32.png) [@mregmi](https://discuss.elastic.co/u/mregmi)\ **Post date:** [April 6, 2016, 9:16pm UTC](https://discuss.elastic.co/t/filebeat-multiline-question/46455/3 "2016-04-06T21:16:27Z")
Thank you for replying. Yes it always starts with INFO= ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [April 7, 2016, 5:39am UTC](https://discuss.elastic.co/t/filebeat-multiline-question/46455/4 "2016-04-07T05:39:34Z")
Okay, so the multiline configuration would be "unless the line starts with INFO=, join the current line with the previous line". ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [April 7, 2016, 11:32am UTC](https://discuss.elastic.co/t/filebeat-multiline-question/46455/5 "2016-04-07T11:32:07Z")
If I understand the logging strategy correctly, a new file is written for basically every message. That is @mregmi always wants to create one events per file. In this case an always match pattern should do the trick. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [April 7, 2016, 12:02pm UTC](https://discuss.elastic.co/t/filebeat-multiline-question/46455/6 "2016-04-07T12:02:39Z")
> If I understand the logging strategy correctly, a new file is written for basically every message. Yes, you're right. ---
**Author:** ![mregmi](https://avatars.discourse-cdn.com/v4/letter/m/2bfe46/32.png) [@mregmi](https://discuss.elastic.co/u/mregmi)\ **Post date:** [April 11, 2016, 3:31am UTC](https://discuss.elastic.co/t/filebeat-multiline-question/46455/7 "2016-04-11T03:31:54Z")
Thank you for your inputs. I was able to create it as a single event and getting indexed into es. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 9:53pm UTC](https://discuss.elastic.co/t/filebeat-multiline-question/46455/8 "2017-07-05T21:53:33Z")