# Filebeat sending multiple lines as one event
**URL:** https://discuss.elastic.co/t/filebeat-sending-multiple-lines-as-one-event/153738
**Category:** Beats
**Tags:** filebeat
**Created:** [October 24, 2018, 7:45am UTC](https://discuss.elastic.co/t/filebeat-sending-multiple-lines-as-one-event/153738 "2018-10-24T07:45:15Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@CyberSeppi](https://discuss.elastic.co/u/CyberSeppi)
#### Post date: [October 24, 2018, 7:45am UTC](https://discuss.elastic.co/t/filebeat-sending-multiple-lines-as-one-event/153738/1 "2018-10-24T07:45:15Z")
Hi there,
I´m sending apache access logs to elasticsearch using filebeat -\> logstash.
The configuration is like that
filebeat.yml
> filebeat.prospectors:
>
> filebeat.config.inputs:
> enabled: true
> path: conf.d/\*.yml
> reload.enabled: true
> reload.period: 10s
>
> output.logstash:
> hosts: ["10.248.114.155:5044"]
> bulk\_max\_size: 5120
conf.d/apache-access-logs.yml
> - type: log
> paths:
The problem (in kibana)
> "message": "`10.100.138.91 vofapl-int-405.bmwgroup.net qx0000 [24/Oct/2018:08:52:02 +0200] \"GET /vofapl_bc/api/v1/planorder_generator/jobs/progress?length=10&type=&status=&scenarioIds= HTTP/1.1\" 200 4016 \"https://vofapl-int-405.bmwgroup.net/vofapl_ui/?conversationid=rDbwV0n1E83xi5h7vqsP&deviceType=1&env=workplace&lang=en&locale=en-US&mwpOrigin=https%3A%2F%2Fworkplace-int4s.bmwgroup.net&role=PFX_PPA&strongAuth=1\" \"Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36\"\n`10.100.138.91 [vofapl-int-405.bmwgroup.net](http://vofapl-int-405.bmwgroup.net) qx0000 [24/Oct/2018:08:52:06 +0200] "GET /vofapl\_bc/api/v1/planorder\_generator/jobs/progress?length=10&type=&status=&scenarioIds= HTTP/1.1" 200 4016 "[https://vofapl-int-405.bmwgroup.net/vofapl\_ui/?conversationid=H6LgGyqd2p4NR10utsKQ&deviceType=1&env=workplace&lang=en&locale=en-US&mwpOrigin=https%3A%2F%2Fworkplace-int4s.bmwgroup.net&role=PFX\_PPA&strongAuth=1\](https://vofapl-int-405.bmwgroup.net/vofapl_ui/?conversationid=H6LgGyqd2p4NR10utsKQ&deviceType=1&env=workplace&lang=en&locale=en-US&mwpOrigin=https%3A%2F%2Fworkplace-int4s.bmwgroup.net&role=PFX_PPA&strongAuth=1%5C)" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36""
As you can see in the message there are 2 lines (but I´ve already see 4 and more) in the message.
Can you give me some hints how I can debug such a problem ?
Many Thanks in advance and greetings,
Cyberseppi
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [October 24, 2018, 7:53am UTC](https://discuss.elastic.co/t/filebeat-sending-multiple-lines-as-one-event/153738/2 "2018-10-24T07:53:02Z")
As it looks like each new event will start with an IP address, this should as far as I can see behave similar to the [timestamp example in the docs](https://www.elastic.co/guide/en/beats/filebeat/6.4/_examples_of_multiline_configuration.html#_timestamps). In that example `multiline.negate` is set to `true`, so I suspect that may be why you are seeing the current behaviour.
---
### Author:  [@CyberSeppi](https://discuss.elastic.co/u/CyberSeppi)
#### Post date: [October 24, 2018, 8:03am UTC](https://discuss.elastic.co/t/filebeat-sending-multiple-lines-as-one-event/153738/3 "2018-10-24T08:03:13Z")
strange thing is, that in most cases it works fine .... there are just a few such cases ☹
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 21, 2018, 8:03am UTC](https://discuss.elastic.co/t/filebeat-sending-multiple-lines-as-one-event/153738/4 "2018-11-21T08:03:14Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.