# Filebeat Multiline Tutorial

**URL:** https://discuss.elastic.co/t/filebeat-multiline-tutorial/49034
**Category:** Beats
**Tags:** filebeat
**Created:** [May 3, 2016, 9:55am UTC](https://discuss.elastic.co/t/filebeat-multiline-tutorial/49034 "2016-05-03T09:55:40Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![jervdv](https://avatars.discourse-cdn.com/v4/letter/j/ed655f/32.png) [@jervdv](https://discuss.elastic.co/u/jervdv)
#### Post date: [May 3, 2016, 9:55am UTC](https://discuss.elastic.co/t/filebeat-multiline-tutorial/49034/1 "2016-05-03T09:55:40Z")

</div>

I'm trying out the filebeat tutorial ( [https://www.elastic.co/guide/en/beats/filebeat/current/configuration-filebeat-options.html](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-filebeat-options.html) ) again after i was stuck with my own pattern.  
Filebeat still sends the logs as different log events.  
Does anyone know how to fix this?

The example log:

```
[beat-logstash-some-name-832-2015.11.28] IndexNotFoundException[no such index]
    at org.elasticsearch.cluster.metadata.IndexNameExpressionResolver$WildcardExpressionResolver.resolve(IndexNameExpressionResolver.java:566)
    at org.elasticsearch.cluster.metadata.IndexNameExpressionResolver.concreteIndices(IndexNameExpressionResolver.java:133)
    at org.elasticsearch.cluster.metadata.IndexNameExpressionResolver.concreteIndices(IndexNameExpressionResolver.java:77)
    at org.elasticsearch.action.admin.indices.delete.TransportDeleteIndexAction.checkBlock(TransportDeleteIndexAction.java:75)

```

Here is my filebeat config:

```
filebeat:
  prospectors:
    -
      paths:
        - /var/log/filebeatmultiline

      input_type: log

      document_type: appConsole

  registry_file: /var/lib/filebeat/registry555555

multiline:
    pattern: ^\[
    negate: true
    match: after

output:
  logstash:
    hosts: ["IP:5044"]
    bulk_max_size: 1024

    tls:
      certificate_authorities: ["/etc/pki/tls/certs/logstash-forwarder.crt"]

shipper:

logging:
  files:
    rotateeverybytes: 10485760 # = 10MB
```

---

<div class="post-metadata">

### Author: ![jervdv](https://avatars.discourse-cdn.com/v4/letter/j/ed655f/32.png) [@jervdv](https://discuss.elastic.co/u/jervdv)
#### Post date: [May 3, 2016, 11:25am UTC](https://discuss.elastic.co/t/filebeat-multiline-tutorial/49034/2 "2016-05-03T11:25:14Z")

</div>

Solved it was a formatting mismatch.

The correct config is:

```
 filebeat:
  prospectors:
    -
      paths:
        - /var/log/filebeatmultiline

      input_type: log

      document_type: appConsole
      multiline:
         pattern: ^\[
         negate: true
         match: after
  registry_file: /var/lib/filebeat/registry5555679

output:
  logstash:
    hosts: ["IP:5044"]
    bulk_max_size: 1024

    tls:
      certificate_authorities: ["/etc/pki/tls/certs/logstash-forwarder.crt"]

shipper:

logging:
  files:
    rotateeverybytes: 10485760 # = 10MB
```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2017, 9:52pm UTC](https://discuss.elastic.co/t/filebeat-multiline-tutorial/49034/3 "2017-07-05T21:52:30Z")

</div>