# Filebeat multiline regexp patterns help **URL:** \ **Category:** Beats\ **Created:** [March 3, 2019, 6:26pm UTC](https://discuss.elastic.co/t/filebeat-multiline-regexp-patterns-help/170648 "2019-03-03T18:26:57Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![pup\_seba](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pup_seba/32/42988_2.png) [@pup\_seba](https://discuss.elastic.co/u/pup_seba)\ **Post date:** [March 3, 2019, 6:26pm UTC](https://discuss.elastic.co/t/filebeat-multiline-regexp-patterns-help/170648/1 "2019-03-03T18:26:57Z")
Hi, I'm trying to use multline in filebeat to ship this application log entry as 1 document to logstash. ``` 2019-02-12 00:01:57,302 WARN [ScheduledTask-1] [name=account@domain.com;mid=1513;ds=CAL-11170;] datasource - Scheduled DataSource import failed. com.zimbra.common.service.ServiceException: resource unreachable: IOException: java.net.SocketTimeoutException: connect timed out ExceptionId:ScheduledTask-1:1549926117299:669654c801f05003 Code:service.RESOURCE_UNREACHABLE at com.zimbra.common.service.ServiceException.RESOURCE_UNREACHABLE(ServiceException.java:310) at com.zimbra.cs.service.FeedManager.retrieveRemoteDatasource(FeedManager.java:360) at com.zimbra.cs.mailbox.Mailbox.importFeed(Mailbox.java:8409) at com.zimbra.cs.mailbox.Mailbox.synchronizeFolder(Mailbox.java:8398) at com.zimbra.cs.datasource.RssImport.importData(RssImport.java:54) at com.zimbra.cs.datasource.DataSourceManager.importData(DataSourceManager.java:403) at com.zimbra.cs.datasource.DataSourceManager.importData(DataSourceManager.java:359) at com.zimbra.cs.datasource.DataSourceTask.call(DataSourceTask.java:83) at com.zimbra.cs.datasource.DataSourceTask.call(DataSourceTask.java:31) at com.zimbra.common.util.TaskScheduler$TaskRunner.call(TaskScheduler.java:79) at java.util.concurrent.FutureTask.run(FutureTask.java:266) at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180) at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) at java.lang.Thread.run(Thread.java:748) Caused by: java.net.SocketTimeoutException: connect timed out at java.net.PlainSocketImpl.socketConnect(Native Method) at java.net.AbstractPlainSocketImpl.doConnect(AbstractPlainSocketImpl.java:350) at java.net.AbstractPlainSocketImpl.connectToAddress(AbstractPlainSocketImpl.java:206) at java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:188) at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:392) at java.net.Socket.connect(Socket.java:589) at com.zimbra.common.net.ProtocolSocketFactoryWrapper.createSocket(ProtocolSocketFactoryWrapper.java:48) at org.apache.commons.httpclient.HttpConnection.open(HttpConnection.java:707) at org.apache.commons.httpclient.MultiThreadedHttpConnectionManager$HttpConnectionAdapter.open(MultiThreadedHttpConnectionManager.java:1361) at org.apache.commons.httpclient.HttpMethodDirector.executeWithRetry(HttpMethodDirector.java:387) at org.apache.commons.httpclient.HttpMethodDirector.executeMethod(HttpMethodDirector.java:171) at org.apache.commons.httpclient.HttpClient.executeMethod(HttpClient.java:397) at com.zimbra.common.httpclient.HttpClientUtil.executeMethod(HttpClientUtil.java:61) at com.zimbra.common.httpclient.HttpClientUtil.executeMethod(HttpClientUtil.java:47) at com.zimbra.cs.service.FeedManager.retrieveRemoteData(FeedManager.java:254) at com.zimbra.cs.service.FeedManager.retrieveRemoteDatasource(FeedManager.java:348) ... 14 more ``` For doing it, I was trying to follow these articles: - [https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html](https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html) - [https://www.elastic.co/guide/en/beats/filebeat/current/\_examples\_of\_multiline\_configuration.html](https://www.elastic.co/guide/en/beats/filebeat/current/_examples_of_multiline_configuration.html) - [https://www.elastic.co/guide/en/beats/filebeat/current/regexp-support.html#grouping](https://www.elastic.co/guide/en/beats/filebeat/current/regexp-support.html#grouping) This is my multiline conf (one of the dozens I've tried ☹ )in the filebeats.yml. multiline.pattern: '\Q"Scheduled DataSource import failed."\E' multiline.negate: true multiline.match: after multiline.flush\_pattern: '[[:space:]]\*(.){3}[[:space:]]more' In this case, it justs matches a lot of things, a lot more than I expected (other log entries, or in this particular case it will match things that go above and below the log sample I provide here). I'm not understanding how to use these regexs. If I try patterns, I can get the expected results in here [https://play.golang.org/](https://play.golang.org/) but when I try them in filebeats, I just can't make them work as expected. What worries me is that this is not even the final form of what I need, as after I get this multiline right, I will need to match several other multiline patrons/texts and I can't seem to find many examples of multiline with filebeat. Any help is more than welcome. ---
**Author:** ![Wolfram\_Haussig](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wolfram_haussig/32/70528_2.png) [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)\ **Post date:** [March 5, 2019, 1:57pm UTC](https://discuss.elastic.co/t/filebeat-multiline-regexp-patterns-help/170648/2 "2019-03-05T13:57:17Z")
Hi, We use the following config in FIleBeat for our java logs: multiline.pattern: ^\d\d\d\d-\d\d-\d\d multiline.negate: true multiline.match: after This creates a new entry each time a timestamp is found, the rest of the lines are appended to the last log entry. ---
**Author:** ![pup\_seba](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pup_seba/32/42988_2.png) [@pup\_seba](https://discuss.elastic.co/u/pup_seba)\ **Post date:** [March 5, 2019, 6:57pm UTC](https://discuss.elastic.co/t/filebeat-multiline-regexp-patterns-help/170648/3 "2019-03-05T18:57:24Z")
Hi Wolfram! That worked perfectly. Even better, your example allowed me to better understand the examples and explanaitions given in the official documentation, so I think that I will be able to keep the log parsing rolling 🙂 Thank you very much for your help! ---
**Author:** ![dedemorton](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dedemorton/32/84409_2.png) [@dedemorton](https://discuss.elastic.co/u/dedemorton)\ **Post date:** [March 6, 2019, 8:43pm UTC](https://discuss.elastic.co/t/filebeat-multiline-regexp-patterns-help/170648/4 "2019-03-06T20:43:54Z")
@Wolfram_Haussig Do you mind if I add your example to the docs? ---
**Author:** ![Wolfram\_Haussig](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wolfram_haussig/32/70528_2.png) [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)\ **Post date:** [March 7, 2019, 6:26am UTC](https://discuss.elastic.co/t/filebeat-multiline-regexp-patterns-help/170648/5 "2019-03-07T06:26:02Z")
Of cours not. I am glad to help. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 4, 2019, 8:36am UTC](https://discuss.elastic.co/t/filebeat-multiline-regexp-patterns-help/170648/6 "2019-04-04T08:36:30Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.