# Filebeat multiline with hints enabled

**URL:** <https://discuss.elastic.co/t/filebeat-multiline-with-hints-enabled/245472>\
**Category:** Beats\
**Tags:** docker, filebeat\
**Created:** [August 18, 2020, 5:24pm UTC](https://discuss.elastic.co/t/filebeat-multiline-with-hints-enabled/245472 "2020-08-18T17:24:09Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![clarkritchie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/clarkritchie/32/65755_2.png) [@clarkritchie](https://discuss.elastic.co/u/clarkritchie)\
**Post date:** [August 18, 2020, 5:24pm UTC](https://discuss.elastic.co/t/filebeat-multiline-with-hints-enabled/245472/1 "2020-08-18T17:24:09Z")

</div>

I've read the multiline documentation so many times now, I am seeing triple.

Our logs are in JSON format and stack traces appear like the example below. When using hints based autodiscovery, is this the correct syntax to use?

```auto
filebeat.autodiscover:
  providers:
    - type: docker
      hints.enabled: true
      multiline.type: pattern
      multiline.pattern: '[[:space:]]'
      multiline.negate: false
      multiline.match: after
      json.overwrite_keys: true
      json.keys_under_root: true
      json.add_error_key: true

```

Example log with Java stack trace:

```auto
{"@timestamp":"2020-08-18T16:43:13.397Z", "log.level":"ERROR", "message":"Servlet.service() for servlet [dispatcherServlet] in context with path [] threw exception [Request processing failed; nested exception is java.lang.NullPointerException] with root cause", "service.name":"muy-cool-app","process.thread.name":"http-nio-5000-exec-5","log.logger":"org.apache.catalina.core.ContainerBase.[Tomcat].[localhost].[/].[dispatcherServlet]","log.origin":{"file.name":"DirectJDKLog.java","function":"log","file.line":181},"error.type":"java.lang.NullPointerException","error.stack_trace":[
	"java.lang.NullPointerException",
	"\tat com.specialized.v2.api.serialnumber.SerialNumberUpload.upload(SerialNumberUpload.java:55)",
	"\tat com.specialized.v2.api.serialnumber.SerialNumberUploadController.serialNumberUpload(SerialNumberUploadController.java:36)",

```

Even the most basic examples (any line that is not the start of an object) aren't collapsing. I've tried several different match patterns in the Go playground and they pass, which makes me think I'm simply not using it correctly in my Filebeat config. I'm confused by the `co.elastic.logs/multiline.pattern` syntax I see sometimes.

Any help here would be greatly appreciated, I am at my wit's end trying to collapse these stack traces. 🤢 Currently on 7.9.0.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 15, 2020, 7:24pm UTC](https://discuss.elastic.co/t/filebeat-multiline-with-hints-enabled/245472/2 "2020-09-15T19:24:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.