# Grok pattern with multiline management in filebeat
**URL:** https://discuss.elastic.co/t/grok-pattern-with-multiline-management-in-filebeat/41903
**Category:** Beats
**Tags:** filebeat
**Created:** [February 16, 2016, 4:06pm UTC](https://discuss.elastic.co/t/grok-pattern-with-multiline-management-in-filebeat/41903 "2016-02-16T16:06:49Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@michelecappelletti](https://discuss.elastic.co/u/michelecappelletti)
#### Post date: [February 16, 2016, 4:06pm UTC](https://discuss.elastic.co/t/grok-pattern-with-multiline-management-in-filebeat/41903/1 "2016-02-16T16:06:49Z")
HI..
i was used to use grok pattern even in multiline 'pattern' section.. it was very useful..
any tip to compensate this on filebeat multiline side??
---
### Author:  [@ruflin](https://discuss.elastic.co/u/ruflin)
#### Post date: [February 16, 2016, 5:16pm UTC](https://discuss.elastic.co/t/grok-pattern-with-multiline-management-in-filebeat/41903/2 "2016-02-16T17:16:03Z")
Grok is currently not supported in filebeat, so there is no work around / compensation. I assume the problem is that the regexp expressions get too complex?
---
### Author:  [@michelecappelletti](https://discuss.elastic.co/u/michelecappelletti)
#### Post date: [February 16, 2016, 5:36pm UTC](https://discuss.elastic.co/t/grok-pattern-with-multiline-management-in-filebeat/41903/3 "2016-02-16T17:36:09Z")
the problem is that this:
pattern =\> "%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{TIME}%{GREEDYDATA}"
become this:
pattern =\> "(?\>\d\d){1,2}-(?:0?[1-9]|1[0-2])-(?:(?:0[1-9])|(?:[12][0-9])|(?:3[01])|[1-9]) (?!\<[0-9])(?:2[0123]|[01]?[0-9]):(?:[0-5][0-9])(?::(?:(?:[0-5][0-9]|60)(?:[:.,][0-9]+)?))(?![0-9])\*"
at least is awful ... think about maintain it ... 😕
and i still have to try if it works, for now ive just done a literal substitution
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [February 16, 2016, 5:53pm UTC](https://discuss.elastic.co/t/grok-pattern-with-multiline-management-in-filebeat/41903/4 "2016-02-16T17:53:01Z")
But do you really need to be that picky? Is it remotely conceivable that you'll have lines that begin with e.g. "9999-32-80 ..." that you need to recognize as _not_ starting with a timestamp? If not that regexp can be vastly simplified.
---
### Author:  [@michelecappelletti](https://discuss.elastic.co/u/michelecappelletti)
#### Post date: [February 16, 2016, 6:05pm UTC](https://discuss.elastic.co/t/grok-pattern-with-multiline-management-in-filebeat/41903/5 "2016-02-16T18:05:32Z")
I've logs that starts like
29-Dec-2015 08:16:30,069|N.A.|ajp-/0.0.0.0:8009-6|org.apache.cxf.i......
2015-12-29 08:51:57.433 - DEBUG - 47afe67..................
and are multiline. U, @magnusbaeck, mean that i could simply check a pattern like
(numeric)^4(-)(numeric)^2(-)(numeric)^2 (numeric)^2(:)(numeric)^2(:)(numeric)^2(:).(numeric)^3
to check this, for example?
2015-12-29 08:51:57.433
if yes, is a good point, ill try.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [February 16, 2016, 6:11pm UTC](https://discuss.elastic.co/t/grok-pattern-with-multiline-management-in-filebeat/41903/6 "2016-02-16T18:11:26Z")
Yes. If you only need to distinguish between "2015-12-29" and "29-Dec-2015" you don't need a very complicated expression.
---
### Author:  [@michelecappelletti](https://discuss.elastic.co/u/michelecappelletti)
#### Post date: [February 17, 2016, 9:24am UTC](https://discuss.elastic.co/t/grok-pattern-with-multiline-management-in-filebeat/41903/7 "2016-02-17T09:24:35Z")
Solution:
29-Dec-2015 08:16:30,069|N.A.|ajp-/0.0.0.0:8009-6|org.apache.cxf.i......
become:
^\d\d-[A-Za-z][A-Za-z][A-Za-z]-\d\d\d\d \d\d:\d\d:\d\d,\d\d\d.\*
and so on..
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2017, 9:55pm UTC](https://discuss.elastic.co/t/grok-pattern-with-multiline-management-in-filebeat/41903/8 "2017-07-05T21:55:38Z")