# Filebeat single prospector with 2 different multiline pattern

**URL:** <https://discuss.elastic.co/t/filebeat-single-prospector-with-2-different-multiline-pattern/114047>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [January 4, 2018, 9:18am UTC](https://discuss.elastic.co/t/filebeat-single-prospector-with-2-different-multiline-pattern/114047 "2018-01-04T09:18:46Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![inhinyera16](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/inhinyera16/32/61625_2.png) [@inhinyera16](https://discuss.elastic.co/u/inhinyera16)\
**Post date:** [January 4, 2018, 9:18am UTC](https://discuss.elastic.co/t/filebeat-single-prospector-with-2-different-multiline-pattern/114047/1 "2018-01-04T09:18:46Z")

</div>

Hello All,

I would like to know if filebeat with single prospector can process 2 different logs with 2 different multiline patterns. If yes, How can i achieve that?

Problem :  
The two below is a sample log format we have. The plan is to store these logs in the same index. These files are fetch in the same directory (so i suppose, we need to use just a single prospector right?). See below :

Log 1 log format  
####Start###  
Field1  
Feild2  
Feild3  
####End###  
####Start###  
Field1  
Feild2  
Feild3  
####End###

filebeat config

```auto
multiline.pattern: '##### START'
multiline.negate: true
multiline.match: after

```

Log 2 log format  
Field1  
Field2  
Field3  
, 7  
Field1  
Field2  
Field3  
, 7

filebeat config

```auto
multiline.pattern: ', 7'
multiline.negate: true
multiline.match: after

```

Now, we wanted to process this logs concurrently. How do we achieve that?

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [January 4, 2018, 1:37pm UTC](https://discuss.elastic.co/t/filebeat-single-prospector-with-2-different-multiline-pattern/114047/2 "2018-01-04T13:37:23Z")

</div>

You can use and or expression (given negate and match are the same):

```auto
multiline.pattern: '^(##### START|, 7)'

```

All prospectors/harvester run concurrently. Each file is processed in isolation. What's wrong with having 2 prospector configs?

btw. `multiline.pattern: '^##### Start'` can be optimized by beats not to use the regular expression engine 🙂

---

<div class="post-metadata">

**Author:** ![inhinyera16](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/inhinyera16/32/61625_2.png) [@inhinyera16](https://discuss.elastic.co/u/inhinyera16)\
**Post date:** [January 5, 2018, 5:25am UTC](https://discuss.elastic.co/t/filebeat-single-prospector-with-2-different-multiline-pattern/114047/3 "2018-01-05T05:25:01Z")

</div>

Thank you so much! I tried it and it works! 😃

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 2, 2018, 5:25am UTC](https://discuss.elastic.co/t/filebeat-single-prospector-with-2-different-multiline-pattern/114047/4 "2018-02-02T05:25:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.