# Filebeat parsing issue

**URL:** https://discuss.elastic.co/t/filebeat-parsing-issue/217914
**Category:** Beats
**Tags:** filebeat
**Created:** [February 5, 2020, 6:47am UTC](https://discuss.elastic.co/t/filebeat-parsing-issue/217914 "2020-02-05T06:47:21Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![Bubunia\_Patra](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bubunia_patra/32/44338_2.png) [@Bubunia\_Patra](https://discuss.elastic.co/u/Bubunia_Patra)
#### Post date: [February 5, 2020, 6:47am UTC](https://discuss.elastic.co/t/filebeat-parsing-issue/217914/1 "2020-02-05T06:47:21Z")

</div>

Hi,

I am trying to fix a issue in the filebeat configuration file where it adds newline to the parsed logs and forwards to graylog/ES. I want the log to be in single line rather than multiple line. Even if the file(access.log) contains multi-line as the input I want to make the file to be single line removing any carriage return and merge to a single line. I am not sure how the multi-line lines are matching in this case as the regex is checking the | and there is no input with date format? Can anyone provide any clue/help?

# filebeat.yml

- type: log  
enabled: 'true'  
paths:
  - "/var/log/nginx/access.log"  
multiline.pattern: "^[0-9]{4}-[0-9]{2}-[0-9]{2}|[A-Z][a-z]{2} [0-9]{2}, [0-9]{4}"  
multiline.negate: 'true'  
multiline.match: after  
fields:  
test.environmentname: testprod  
fields\_under\_root: true

# Input

ID: 253443  
Address: [http://192.168.0.1:8181/broadcast/?test=test1&=](http://192.168.0.1:8181/broadcast/?test=test1&=)  
Encoding: UTF-8  
Http-Method: POST  
Content-Type: application/json  
Headers: {Accept=[application/json]}

# Expected output

ID: 253443 Address: [http://192.168.0.1:8181/broadcast/?test=test1&=](http://192.168.0.1:8181/broadcast/?test=test1&=) Encoding: UTF-8 Http-Method: POST Content-Type: application/json Headers: {Accept=[application/json]

Regards  
Pradeep

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 4, 2020, 6:54am UTC](https://discuss.elastic.co/t/filebeat-parsing-issue/217914/2 "2020-03-04T06:54:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.