# Filebeat System Module - Multi-line Log Generating One Log Per Line **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [June 9, 2020, 7:18pm UTC](https://discuss.elastic.co/t/filebeat-system-module-multi-line-log-generating-one-log-per-line/236410 "2020-06-09T19:18:53Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![uklipse](https://avatars.discourse-cdn.com/v4/letter/u/cdc98d/32.png) [@uklipse](https://discuss.elastic.co/u/uklipse)\ **Post date:** [June 9, 2020, 7:18pm UTC](https://discuss.elastic.co/t/filebeat-system-module-multi-line-log-generating-one-log-per-line/236410/1 "2020-06-09T19:18:53Z")
I'm enabling the system module of filebeat for the first time on a Ubuntu server. I can see the logs but it's taking what looks like it's taking multiline logs and placing them into single logs per line. Some logs only have a single }. Everything is default during my setup except for locations of logstash. ---
**Author:** ![ChrsMark](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrsmark/32/55858_2.png) [@ChrsMark](https://discuss.elastic.co/u/ChrsMark)\ **Post date:** [June 10, 2020, 8:12am UTC](https://discuss.elastic.co/t/filebeat-system-module-multi-line-log-generating-one-log-per-line/236410/2 "2020-06-10T08:12:53Z")
Hi! Maybe you need to [override input settings](https://www.elastic.co/guide/en/beats/filebeat/current/advanced-settings.html) and set properly the multiline settings: [https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html](https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html) ---
**Author:** ![uklipse](https://avatars.discourse-cdn.com/v4/letter/u/cdc98d/32.png) [@uklipse](https://discuss.elastic.co/u/uklipse)\ **Post date:** [June 10, 2020, 12:51pm UTC](https://discuss.elastic.co/t/filebeat-system-module-multi-line-log-generating-one-log-per-line/236410/3 "2020-06-10T12:51:58Z")
That didn't fix the issue. When setting that to true, I didn't see any logs come in. The description of the system module says under the hood it will make sure multiline messages get treated as a single event but that doesn't appear to be happening. [https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-system.html](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-system.html) ---
**Author:** ![ChrsMark](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrsmark/32/55858_2.png) [@ChrsMark](https://discuss.elastic.co/u/ChrsMark)\ **Post date:** [June 10, 2020, 1:06pm UTC](https://discuss.elastic.co/t/filebeat-system-module-multi-line-log-generating-one-log-per-line/236410/4 "2020-06-10T13:06:07Z")
Hmmm, could you provide some logs samples please? I could try to reproduce your issue. ---
**Author:** ![uklipse](https://avatars.discourse-cdn.com/v4/letter/u/cdc98d/32.png) [@uklipse](https://discuss.elastic.co/u/uklipse)\ **Post date:** [June 10, 2020, 1:12pm UTC](https://discuss.elastic.co/t/filebeat-system-module-multi-line-log-generating-one-log-per-line/236410/5 "2020-06-10T13:12:57Z")
All the logs are just single lines so I can't really send them to you but here is a screenshot showing just the message field and you can see the end of one log and beginning of another but some individual logs are just closing } brackets. It only does this when I enable the system module. ![Multiline](https://us1.discourse-cdn.com/elastic/original/3X/5/9/592411f3da66463ade74c1e75834a78dd3932b4f.png) ---
**Author:** ![ChrsMark](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrsmark/32/55858_2.png) [@ChrsMark](https://discuss.elastic.co/u/ChrsMark)\ **Post date:** [June 12, 2020, 7:27am UTC](https://discuss.elastic.co/t/filebeat-system-module-multi-line-log-generating-one-log-per-line/236410/6 "2020-06-12T07:27:49Z")
Hi! I see you are trying to parse Metricbeat's logs using system module 🤔? In principle I don't think this will work. As [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-system.html) mentions `The system module collects and parses logs created by the system logging service of common Unix/Linux based distributions.` . ---
**Author:** ![uklipse](https://avatars.discourse-cdn.com/v4/letter/u/cdc98d/32.png) [@uklipse](https://discuss.elastic.co/u/uklipse)\ **Post date:** [June 15, 2020, 9:06pm UTC](https://discuss.elastic.co/t/filebeat-system-module-multi-line-log-generating-one-log-per-line/236410/7 "2020-06-15T21:06:02Z")
So I figured out what was going on. Metricbeat by default will send it's logs to syslog even if you have it defined in the metricbeat.yml config file not to so the filebeat system module was still picking this up. I was able to override the default setting based on this post and this resolved the issue. > [@Metribeat 7.1.1 not logging to files, only syslog always](https://discuss.elastic.co/t/metribeat-7-1-1-not-logging-to-files-only-syslog-always/187088): > > Hello Metricbeat does not stop sending logs to syslog. Even after parameter in metricbeat.yml: logging.to\_syslog: false This happens if you run metricbeat (ubuntu 16.04): service metricbeat start It helps only run with command: /usr/share/metricbeat/bin/metricbeat -c /etc/metricbeat/metricbeat.yml -path.logs /var/log/metricbeat I also noticed that when running through systemd, command has option "-e": /usr/share/metricbeat/bin/metricbeat -e -c /etc/metricbeat/metricbeat.yml ... There m… ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 13, 2020, 11:06pm UTC](https://discuss.elastic.co/t/filebeat-system-module-multi-line-log-generating-one-log-per-line/236410/8 "2020-07-13T23:06:07Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.