# Filebeat subdirectories and logstash multiline problems

**URL:** <https://discuss.elastic.co/t/filebeat-subdirectories-and-logstash-multiline-problems/52060>\
**Category:** Logstash\
**Created:** [June 7, 2016, 11:42am UTC](https://discuss.elastic.co/t/filebeat-subdirectories-and-logstash-multiline-problems/52060 "2016-06-07T11:42:32Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![elkforce](https://avatars.discourse-cdn.com/v4/letter/e/b3f665/32.png) [@elkforce](https://discuss.elastic.co/u/elkforce)\
**Post date:** [June 7, 2016, 11:42am UTC](https://discuss.elastic.co/t/filebeat-subdirectories-and-logstash-multiline-problems/52060/1 "2016-06-07T11:42:32Z")

</div>

Hello,

i want ship user logs(java multiline) with filebeat to logstash, but the multiline Events get events from another Event.

MY CONFIG:  
The user logs are:  
/tmp/user1/application.log  
/tmp/user2/application.log  
/tmp/user3/application.log  
/tmp/user4/application.log  
.  
.  
.  
.  
and so on

My filebeat ship to logstash:

filebeat:

# List of prospectors to fetch data.

prospectors:  
# Each - is a prospector. Below are the prospector specific configurations  
-  
paths:  
- /tmp/\*/application.log

Logstashserver with beats input and my filter:

```
    multiline {
            patterns_dir => "/etc/logstash/conf.d/grok_patter"
            pattern => "^%{TIMESSTAMP}"
            negate => true
            what => "previous"
    }
    grok {
            patterns_dir => "/etc/logstash/conf.d/grok_patter"
            match => {
                    "message" => "%{TIMESSTAMP:logging_time} \| %{LOGLEVEL:level} \| %{DATA:threadname} \| %{JAVACLASS:class} \| %{SPACE} \| %{JAVALOGMESSAGE:logmessage}"
            }
            add_field => ["IndexName", "client-application"]
    }
    grok {
            match => ["source", "/tmp/(?<userid>[^/]+)/(?<filename>[^/]+)" ]
            
            }
    date { 
            match => ["logging_time" , "dd MMM yyyy HH:mm:ss,SSS", "MMM yyyy HH:mm:ss,SSS"]
    }

```

Json Output is:  
"source": [  
"/tmp/user1/application.log",  
"/tmp/user10/application.log",  
],  
"filename": [  
"application.log",  
"application.log"  
]  
"userid": [  
"user1",  
"user10"  
],

What is wrong, why is userid, filename and source duplicated. Any ideas?

br

---

<div class="post-metadata">

**Author:** ![elkforce](https://avatars.discourse-cdn.com/v4/letter/e/b3f665/32.png) [@elkforce](https://discuss.elastic.co/u/elkforce)\
**Post date:** [June 8, 2016, 8:26am UTC](https://discuss.elastic.co/t/filebeat-subdirectories-and-logstash-multiline-problems/52060/2 "2016-06-08T08:26:57Z")

</div>

Hello,

somebody has an idea where the error is?

---

<div class="post-metadata">

**Author:** ![elkforce](https://avatars.discourse-cdn.com/v4/letter/e/b3f665/32.png) [@elkforce](https://discuss.elastic.co/u/elkforce)\
**Post date:** [June 9, 2016, 8:49am UTC](https://discuss.elastic.co/t/filebeat-subdirectories-and-logstash-multiline-problems/52060/3 "2016-06-09T08:49:39Z")

</div>

With logstash direct input file and without filebeat as shipper, the problem is gone

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:53am UTC](https://discuss.elastic.co/t/filebeat-subdirectories-and-logstash-multiline-problems/52060/4 "2017-07-06T04:53:55Z")

</div>

Closed on July 6, 2017, 4:53am UTC