# Filebeat to logstash multiline issue with network

**URL:** <https://discuss.elastic.co/t/filebeat-to-logstash-multiline-issue-with-network/270693>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [April 20, 2021, 11:04am UTC](https://discuss.elastic.co/t/filebeat-to-logstash-multiline-issue-with-network/270693 "2021-04-20T11:04:18Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ahmed\_Abdulaleem](https://avatars.discourse-cdn.com/v4/letter/a/90ced4/32.png) [@Ahmed\_Abdulaleem](https://discuss.elastic.co/u/Ahmed_Abdulaleem)\
**Post date:** [April 20, 2021, 11:04am UTC](https://discuss.elastic.co/t/filebeat-to-logstash-multiline-issue-with-network/270693/1 "2021-04-20T11:04:18Z")

</div>

Greetings,  
I installed file beat 7.12 with multiline pattern and the output is log stash 7.12 the problem is when file beat be in same network subnet the multiline shipped correctly  
otherwise with a different network subnet, the multiline dropped as attached image

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/4/24082ff249072226579134d6aea264c846321e31.png)

multiline setting

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/1/a12ea1bb11ae8f324ccaca11dc50e18b418b53bd.png)

---

<div class="post-metadata">

**Author:** ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)\
**Post date:** [April 22, 2021, 1:14am UTC](https://discuss.elastic.co/t/filebeat-to-logstash-multiline-issue-with-network/270693/2 "2021-04-22T01:14:23Z")

</div>

I think u may need to update your multi line pattern. The logs above the line are not multi line while the one below is.

---

<div class="post-metadata">

**Author:** ![Ahmed\_Abdulaleem](https://avatars.discourse-cdn.com/v4/letter/a/90ced4/32.png) [@Ahmed\_Abdulaleem](https://discuss.elastic.co/u/Ahmed_Abdulaleem)\
**Post date:** [April 22, 2021, 6:21am UTC](https://discuss.elastic.co/t/filebeat-to-logstash-multiline-issue-with-network/270693/3 "2021-04-22T06:21:31Z")

</div>

Thank you @legoguy1000 .

i tested same log file with same file beat multiline setting one from the same network subnet and this shipped correctly like last log in the attached image.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/e/7e575baa4008e7b30336da50a1a30a26e4244726.png)  
and other from different network subnet and logs not shipped correctly like two first line in the attached image  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/1/c1bde6caf045fc1ee1f4c4a2e2c6fb08e576878a.png)

---

<div class="post-metadata">

**Author:** ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)\
**Post date:** [April 22, 2021, 12:11pm UTC](https://discuss.elastic.co/t/filebeat-to-logstash-multiline-issue-with-network/270693/4 "2021-04-22T12:11:35Z")

</div>

what did u update the multiline pattern too? I don't have a a lot of experience with the multiline settings. I would look at [Manage multiline messages | Filebeat Reference [7.12] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html) for more info.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 20, 2021, 12:12pm UTC](https://discuss.elastic.co/t/filebeat-to-logstash-multiline-issue-with-network/270693/5 "2021-05-20T12:12:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.