# Filebeat to ouput which pattern matched from the include\_lines list **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [June 7, 2017, 3:38pm UTC](https://discuss.elastic.co/t/filebeat-to-ouput-which-pattern-matched-from-the-include-lines-list/88600 "2017-06-07T15:38:40Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![ragurajendran86](https://avatars.discourse-cdn.com/v4/letter/r/a3d4f5/32.png) [@ragurajendran86](https://discuss.elastic.co/u/ragurajendran86)\ **Post date:** [June 7, 2017, 3:38pm UTC](https://discuss.elastic.co/t/filebeat-to-ouput-which-pattern-matched-from-the-include-lines-list/88600/1 "2017-06-07T15:38:40Z")
We use file beat extensively to capture exception in the log files. We define all the error pattern inside the include\_lines in the prospector section in array. This can identify the error pattern and using multi line it aggregates errors lines and sends me the event. However, the info about which pattern is matched currently from the array of patterns is not shown in the result. It would be nice to show matched\_pattern value in the output when include\_lines is used. I also understand when RegEx is used to match we cannot output any match pattern. ---
**Author:** ![exekias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/exekias/32/28718_2.png) [@exekias](https://discuss.elastic.co/u/exekias)\ **Post date:** [June 12, 2017, 8:52am UTC](https://discuss.elastic.co/t/filebeat-to-ouput-which-pattern-matched-from-the-include-lines-list/88600/2 "2017-06-12T08:52:48Z")
Hi, It looks to me that you want to do some extra processing to the message, I think Logstash would be the right place to do it, please check grok documentation to see if it fits your needs: [https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html) ---
**Author:** ![ragurajendran86](https://avatars.discourse-cdn.com/v4/letter/r/a3d4f5/32.png) [@ragurajendran86](https://discuss.elastic.co/u/ragurajendran86)\ **Post date:** [June 14, 2017, 12:48am UTC](https://discuss.elastic.co/t/filebeat-to-ouput-which-pattern-matched-from-the-include-lines-list/88600/3 "2017-06-14T00:48:59Z")
Hi, sorry i feel i didn't explain it clearly. For example in my filebeat config, i have the following... filebeat.prospectors: - paths: - /var/log/myapp/\*.log include\_lines: ['^ERROR', '^WARN'] when it outputs, i expect filebeat to include attribute like "mattched\_pattern":"ERROR" or "mattched\_pattern":"WARN"... since each events will be matched based on this include\_lines..... currently it outputs only message attribute, which gives the complete error detail.. but i cant identify which pattern matched from the list.... ---
**Author:** ![ragurajendran86](https://avatars.discourse-cdn.com/v4/letter/r/a3d4f5/32.png) [@ragurajendran86](https://discuss.elastic.co/u/ragurajendran86)\ **Post date:** [June 14, 2017, 12:51am UTC](https://discuss.elastic.co/t/filebeat-to-ouput-which-pattern-matched-from-the-include-lines-list/88600/4 "2017-06-14T00:51:35Z")
exekias, i have explained my req below. please take a look. ---
**Author:** ![exekias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/exekias/32/28718_2.png) [@exekias](https://discuss.elastic.co/u/exekias)\ **Post date:** [June 14, 2017, 9:24am UTC](https://discuss.elastic.co/t/filebeat-to-ouput-which-pattern-matched-from-the-include-lines-list/88600/5 "2017-06-14T09:24:57Z")
Yes, I think this is not possible with filebeat, as we don't normally do processing on messages, but shipping. You need to use Logstash for this, take a look to the given documentation ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 12, 2017, 9:25am UTC](https://discuss.elastic.co/t/filebeat-to-ouput-which-pattern-matched-from-the-include-lines-list/88600/6 "2017-07-12T09:25:02Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.