# Filebeat multinline don't work

**URL:** <https://discuss.elastic.co/t/filebeat-multinline-dont-work/355650>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 18, 2024, 6:46pm UTC](https://discuss.elastic.co/t/filebeat-multinline-dont-work/355650 "2024-03-18T18:46:31Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Exdar](https://avatars.discourse-cdn.com/v4/letter/e/bc8723/32.png) [@Exdar](https://discuss.elastic.co/u/Exdar)\
**Post date:** [March 18, 2024, 6:46pm UTC](https://discuss.elastic.co/t/filebeat-multinline-dont-work/355650/1 "2024-03-18T18:46:31Z")

</div>

Hi all.  
I have a problem with filebeat multinline

filebeat.yml Input

```auto
- type: log
  id: onetest
  enabled: true
  tags: ["onetest"]
  parsers:
    - multinline:
      type: pattern
      pattern: '(\d\d:\d\d)\.(\d+)-(\d+)'
      negative: true
      match: after
  paths:
   - c:/Test/MyLog/*.log

```

input.conf in logstash

```auto
match => { "message" => "Sql=[\"\']%{INSIDEQUOTES:sql_text}[\"\']" }
INSIDEQUOTES ([^"']*)

```

example log file:

```auto
01:42.205063-2186916,EXCPCNTX,4,Sql="SELECT TOP 30
CASE WHEN (T1._Fld16574_TYPE = 0x08 AND ..."

```

But in console output I got:

`"message" => "CASE WHEN (T1._Fld16574_TYPE = 0x08 AND`

Filebeat splits a logical line into multiple lines, as if the pattern doesn't work. In grok debugger all works great.

---

<div class="post-metadata">

**Author:** ![rtwolfe94022](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rtwolfe94022/32/132253_2.png) [@rtwolfe94022](https://discuss.elastic.co/u/rtwolfe94022)\
**Post date:** [March 19, 2024, 3:28am UTC](https://discuss.elastic.co/t/filebeat-multinline-dont-work/355650/2 "2024-03-19T03:28:48Z")

</div>

Your Filebeat multiline configuration has a typo: it should be `multiline` instead of `multinline` . Correct this and ensure your pattern matches the beginning of your log messages. Restart Filebeat after making these changes to apply them.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 16, 2024, 5:29am UTC](https://discuss.elastic.co/t/filebeat-multinline-dont-work/355650/3 "2024-04-16T05:29:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.