# How to configurate filebeats for muliline log file **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [December 21, 2015, 9:54am UTC](https://discuss.elastic.co/t/how-to-configurate-filebeats-for-muliline-log-file/37679 "2015-12-21T09:54:15Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![swelltt0576](https://avatars.discourse-cdn.com/v4/letter/s/a6a055/32.png) [@swelltt0576](https://discuss.elastic.co/u/swelltt0576)\ **Post date:** [December 21, 2015, 9:54am UTC](https://discuss.elastic.co/t/how-to-configurate-filebeats-for-muliline-log-file/37679/1 "2015-12-21T09:54:15Z")
hi, i have a file just like this: ```auto 2015-12-21 17:44:31,922 ERROR c.e.u.e.e.E2BService. [pool-2-thread-519] Connect to localhost:80 [localhost/127.0.0.1] failed: Connection refused org.apache.http.conn.HttpHostConnectException: Connect to localhost:80 [localhost/127.0.0.1] failed: Connection refused at org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:151) ~[httpclient-4.5.1.jar:4.5.1] at org.apache.http.impl.conn.PoolingHttpClientConnectionManager.connect(PoolingHttpClientConnectionManager.java:353) ~[httpclient-4.5.1.jar:4.5.1] at org.apache.http.impl.execchain.MainClientExec.establishRoute(MainClientExec.java:380) ~[httpclient-4.5.1.jar:4.5.1] at org.apache.http.impl.execchain.MainClientExec.execute(MainClientExec.java:236) ~[httpclient-4.5.1.jar:4.5.1] at org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec.java:184) ~[httpclient-4.5.1.jar:4.5.1] at org.apache.http.impl.execchain.RetryExec.execute(RetryExec.java:88) ~[httpclient-4.5.1.jar:4.5.1] at org.apache.http.impl.execchain.RedirectExec.execute(RedirectExec.java:110) ~[httpclient-4.5.1.jar:4.5.1] at org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:184) ~[httpclient-4.5.1.jar:4.5.1] at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:82) ~[httpclient-4.5.1.jar:4.5.1] at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:107) ~[httpclient-4.5.1.jar:4.5.1] at com.elinku.ums.et.e2b.E2BService.sendE2BRequest(E2BService.java:48) [ums-et-api-1.1.3-RELEASES.jar:?] at com.elinku.ums.core.MpQQService.processQ2ETextMo(MpQQService.java:160) [ums-core-service-1.1.3-RELEASES.jar:?] at com.elinku.ums.core.MpQQService.processQ2ERequest(MpQQService.java:128) [ums-core-service-1.1.3-RELEASES.jar:?] at com.elinku.ums.core.CoreService.processQ2E(CoreService.java:60) [ums-core-service-1.1.3-RELEASES.jar:?] at com.elinku.ums.core.Q2EProcessor.run(Q2EProcessor.java:32) [ums-core-service-1.1.3-RELEASES.jar:?] at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [?:1.8.0_66] at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [?:1.8.0_66] at java.lang.Thread.run(Thread.java:745) [?:1.8.0_66] Caused by: java.net.ConnectException: Connection refused at java.net.PlainSocketImpl.socketConnect(Native Method) ~[?:1.8.0_66] at java.net.AbstractPlainSocketImpl.doConnect(AbstractPlainSocketImpl.java:350) ~[?:1.8.0_66] at java.net.AbstractPlainSocketImpl.connectToAddress(AbstractPlainSocketImpl.java:206) ~[?:1.8.0_66] at java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:188) ~[?:1.8.0_66] at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:392) ~[?:1.8.0_66] at java.net.Socket.connect(Socket.java:589) ~[?:1.8.0_66] at org.apache.http.conn.socket.PlainConnectionSocketFactory.connectSocket(PlainConnectionSocketFactory.java:74) ~[httpclient-4.5.1.jar:4.5.1] at org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:134) ~[httpclient-4.5.1.jar:4.5.1] ... 17 more ``` when i use the default config to load the log into logstash , i find that there more than 1 message in the logstash. it is clearly that filebeat provide multi-event for this log, but i want there event can be combined into one event. how can i do? thanks . ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [December 21, 2015, 12:10pm UTC](https://discuss.elastic.co/t/how-to-configurate-filebeats-for-muliline-log-file/37679/2 "2015-12-21T12:10:17Z")
multiline support is about to be added to filebeat. For reference see: [https://github.com/elastic/beats/issues/461](https://github.com/elastic/beats/issues/461) and [https://github.com/elastic/beats/pull/570](https://github.com/elastic/beats/pull/570). I think most recent logstash also has support for multiline. ---
**Author:** ![swelltt0576](https://avatars.discourse-cdn.com/v4/letter/s/a6a055/32.png) [@swelltt0576](https://discuss.elastic.co/u/swelltt0576)\ **Post date:** [December 24, 2015, 5:54am UTC](https://discuss.elastic.co/t/how-to-configurate-filebeats-for-muliline-log-file/37679/3 "2015-12-24T05:54:38Z")
i got, thank you very much ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 9:57pm UTC](https://discuss.elastic.co/t/how-to-configurate-filebeats-for-muliline-log-file/37679/4 "2017-07-05T21:57:14Z")