# Filebeat regexp

**URL:** https://discuss.elastic.co/t/filebeat-regexp/191792
**Category:** Beats
**Tags:** filebeat
**Created:** [July 23, 2019, 10:56am UTC](https://discuss.elastic.co/t/filebeat-regexp/191792 "2019-07-23T10:56:08Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)
#### Post date: [July 25, 2019, 6:23pm UTC](https://discuss.elastic.co/t/filebeat-regexp/191792/2 "2019-07-25T18:23:24Z")

</div>

Hello @O.Shulha,

Looking the regular expression you are using I think it's almost correct.  
The pattern should be:

```auto
  multiline.pattern: '^ncs:.*'

```

looking a the other errors which come from the elasticsearch output, I think its a mapping issues, and there is some work around and solution in [Logstash errors after upgrading to filebeat-6.3.0](https://discuss.elastic.co/t/logstash-errors-after-upgrading-to-filebeat-6-3-0/135984/6)

```auto
[2019-07-23T09:20:55,281][WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"logstash-syslog-2019.07.23", :_type=>"_doc", :routing=>nil}, #<LogStash::Event:0x6cde57c2>], :response=>{"index"=>{"_index"=>"logstash-syslog-2019.07.23", "_type"=>"_doc", "_id"=>"-sciHmwBv7eJVn6lOJd9", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [host] of type [text] in document with id '-sciHmwBv7eJVn6lOJd9'", "caused_by"=>{"type"=>"illegal_state_exception", "reason"=>"Can't get text on a START_OBJECT at 1:75"}}}}}

```

---

_[View the full topic](https://discuss.elastic.co/t/filebeat-regexp/191792)._