# How can we put multiline filter for below custom log

**URL:** <https://discuss.elastic.co/t/how-can-we-put-multiline-filter-for-below-custom-log/213161>\
**Category:** Logstash\
**Created:** [December 27, 2019, 8:58am UTC](https://discuss.elastic.co/t/how-can-we-put-multiline-filter-for-below-custom-log/213161 "2019-12-27T08:58:46Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![KashinathPatil](https://avatars.discourse-cdn.com/v4/letter/k/91b2a8/32.png) [@KashinathPatil](https://discuss.elastic.co/u/KashinathPatil)\
**Post date:** [December 27, 2019, 8:58am UTC](https://discuss.elastic.co/t/how-can-we-put-multiline-filter-for-below-custom-log/213161/1 "2019-12-27T08:58:46Z")

</div>

# MachineName: PC00287 TimeStamp: 12/19/2019 6:18:33 PM FullName: POA.ReaserchSolution.Infrastructure.Logging, Version=2.51.7292.26907, Culture=neutral, PublicKeyToken=null AppDomainName: /RM/W3SVC/4/ROOT-2-132212323240900481 WindowsIdentity: IIS APPPOOL\shop Message: The content type text/html; charset=utf-8 of the response message does not match the content type of the binding (application/soap+xml; charset=utf-8). stack trace: at System.ServiceModel.Channels.HttpChannelUtilities.ValidateRequestReplyResponse(HttpWebRequest request, HttpWebResponse response, HttpChannelFactory`1 factory, WebException responseException, ChannelBinding channelBinding)

# MachineName: PC00287 TimeStamp: 12/20/2019 6:18:34 PM FullName: POA.ReaserchSolution.Infrastructure.Logging, Version=2.51.7292.26907, Culture=neutral, PublicKeyToken=null AppDomainName: /RM/W3SVC/4/ROOT-2-132212323240900481 WindowsIdentity: IIS APPPOOL\shop Message: The content type text/html; charset=utf-8 of the response message does not match the content type of the binding (application/soap+xml; charset=utf-8). stack trace: at System.ServiceModel.Channels.HttpChannelUtilities.ValidateRequestReplyResponse(HttpWebRequest request, HttpWebResponse response, HttpChannelFactory`1 factory, WebException responseException, ChannelBinding channelBinding)

# MachineName: PC00288 TimeStamp: 12/21/2019 6:18:35 PM FullName: POA.ReaserchSolution.Infrastructure.Logging, Version=2.51.7292.26907, Culture=neutral, PublicKeyToken=null AppDomainName: /RM/W3SVC/4/ROOT-2-132212323240900481 WindowsIdentity: IIS APPPOOL\shop Message: The content type text/html; charset=utf-8 of the response message does not match the content type of the binding (application/soap+xml; charset=utf-8). stack trace: at System.ServiceModel.Channels.HttpChannelUtilities.ValidateRequestReplyResponse(HttpWebRequest request, HttpWebResponse response, HttpChannelFactory`1 factory, WebException responseException, ChannelBinding channelBinding)

# MachineName: PC00288 TimeStamp: 12/21/2019 6:18:35 PM FullName: POA.ReaserchSolution.Infrastructure.Logging, Version=2.51.7292.26907, Culture=neutral, PublicKeyToken=null AppDomainName: /RM/W3SVC/4/ROOT-2-132212323240900481 WindowsIdentity: IIS APPPOOL\shop Message: The content type text/html; charset=utf-8 of the response message does not match the content type of the binding (application/soap+xml; charset=utf-8). stack trace: at System.ServiceModel.Channels.HttpChannelUtilities.ValidateRequestReplyResponse(HttpWebRequest request, HttpWebResponse response, HttpChannelFactory`1 factory, WebException responseException, ChannelBinding channelBinding)

---

<div class="post-metadata">

**Author:** ![Marta\_Zagrajek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marta_zagrajek/32/47442_2.png) [@Marta\_Zagrajek](https://discuss.elastic.co/u/Marta_Zagrajek)\
**Post date:** [December 27, 2019, 1:18pm UTC](https://discuss.elastic.co/t/how-can-we-put-multiline-filter-for-below-custom-log/213161/2 "2019-12-27T13:18:15Z")

</div>

It is good to use multiline in filebeat. Do you have that configuration there?

---

<div class="post-metadata">

**Author:** ![KashinathPatil](https://avatars.discourse-cdn.com/v4/letter/k/91b2a8/32.png) [@KashinathPatil](https://discuss.elastic.co/u/KashinathPatil)\
**Post date:** [December 27, 2019, 1:21pm UTC](https://discuss.elastic.co/t/how-can-we-put-multiline-filter-for-below-custom-log/213161/3 "2019-12-27T13:21:45Z")

</div>

It doesnt matter. even from filebeat we require to filter the data.

---

<div class="post-metadata">

**Author:** ![Marta\_Zagrajek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marta_zagrajek/32/47442_2.png) [@Marta\_Zagrajek](https://discuss.elastic.co/u/Marta_Zagrajek)\
**Post date:** [December 27, 2019, 1:23pm UTC](https://discuss.elastic.co/t/how-can-we-put-multiline-filter-for-below-custom-log/213161/4 "2019-12-27T13:23:09Z")

</div>

Could you include your filebeat and logstash configuration file?

---

<div class="post-metadata">

**Author:** ![Marta\_Zagrajek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marta_zagrajek/32/47442_2.png) [@Marta\_Zagrajek](https://discuss.elastic.co/u/Marta_Zagrajek)\
**Post date:** [December 27, 2019, 1:28pm UTC](https://discuss.elastic.co/t/how-can-we-put-multiline-filter-for-below-custom-log/213161/5 "2019-12-27T13:28:39Z")

</div>

It can be something like that, if all those begin with Machine

> `^MachineName:\s\D{2}\d{5}`

or more universal:

> ^MachineName.\*

---

<div class="post-metadata">

**Author:** ![KashinathPatil](https://avatars.discourse-cdn.com/v4/letter/k/91b2a8/32.png) [@KashinathPatil](https://discuss.elastic.co/u/KashinathPatil)\
**Post date:** [December 27, 2019, 1:36pm UTC](https://discuss.elastic.co/t/how-can-we-put-multiline-filter-for-below-custom-log/213161/6 "2019-12-27T13:36:09Z")

</div>

> [@Marta\_Zagrajek](#):
>
> something like that, if all those begin with Machine

Thanks, anyway I have created the filter  
grok {  
patterns\_dir =\> "C:/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-patterns-core-4.1.2/patterns"  
match =\> ["message", "\s_MachineName: %{HOSTNAME:HostName}\s_\n\s_TimeStamp: %{DATESTAMP:myLogDate} PM\s_FullName: %{JAVACLASS:className}, Version=%{BASE16FLOAT:className}.%{BASE16NUM:className}%{GREEDYDATA:className}\s_AppDomainName: %{URIPATHPARAM:URL}%{GREEDYDATA}\s_WindowsIdentity: %{GREEDYDATA:WinIdentity}\s\*"]

```
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 24, 2020, 1:36pm UTC](https://discuss.elastic.co/t/how-can-we-put-multiline-filter-for-below-custom-log/213161/7 "2020-01-24T13:36:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.