# How to get 10 before and after lines if pattern is matched in multiline in Filebeat **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [June 20, 2018, 12:37pm UTC](https://discuss.elastic.co/t/how-to-get-10-before-and-after-lines-if-pattern-is-matched-in-multiline-in-filebeat/136689 "2018-06-20T12:37:59Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![RameshNagargoje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rameshnagargoje/32/30212_2.png) [@RameshNagargoje](https://discuss.elastic.co/u/RameshNagargoje)\ **Post date:** [June 20, 2018, 12:38pm UTC](https://discuss.elastic.co/t/how-to-get-10-before-and-after-lines-if-pattern-is-matched-in-multiline-in-filebeat/136689/1 "2018-06-20T12:38:00Z")
## here is my input / # [349.472726] audit: rate limit exceeded [359.080131] android\_reboot: Start sync before filesystem remount as read-only ... [359.177696] android\_reboot: sync done [359.182012] SysRq : Emergency Remount R/O [359.186100] hda-intel: IRQ timing workaround is activated for card #0. Suggest a bigger bdl\_pos\_adj. [359.194902] EXT4-fs (sda22): re-mounted. Opts: (null) [359.211514] EXT4-fs (sda23): re-mounted. Opts: (null) [359.222850] EXT4-fs (sda24): re-mounted. Opts: (null) [359.299410] EXT4-fs (sda32): re-mounted. Opts: (null) [359.324908] EXT4-fs (sda28): re-mounted. Opts: (null) [359.337432] Emergency Remount complete [359.388507] Freezing user space processes ... (elapsed 0.001 seconds) done. [359.397247] nvdumper: rebooting cleanly. [359.401215] nvdumper: set\_dirty\_state 0xf000caf3 [359.420890] sd 0:0:0:0: [sda] Synchronizing SCSI cache [359.440732] therm-fan-est: shutting down [359.445004] wifi\_platform\_set\_power = 0 [359.449696] gk20a gpu.0: shutting down [360.981636] dhdsdio\_clk\_kso\_enab\> op:KSO\_SET, ERROR: try\_cnt:3, rd\_val:ff, ERR:ffffffdd [360.989875] ERROR: kso set failed retry: 0 [360.998099] dhdsdio\_clk\_devsleep\_iovar: Sleep request failed: kso:0 on:0 err:-35 [361.005905] dhdsdio\_dpc: FAILEDnewstatusREAD, LINE 5987 [361.013201] dhdsdio\_dpc: failed backplane access over SDIO, halting operation [364.459721] gk20a gpu.0: gk20a\_pmu\_save\_zbc: ZBC save timeout [364.466240] gk20a gpu.0: shut down complete [364.516048] late\_shutdown started [364.519364] platform-i2c 7000d100.i2c: Shutting down [364.524078] platform-i2c 7000d000.i2c: Shutting down [364.528777] platform-i2c 7000c700.i2c: Shutting down [364.533753] platform-i2c 7000c500.i2c: Shutting down [364.538450] platform-i2c 7000c400.i2c: Shutting down [364.543156] platform-i2c 7000c000.i2c: Shutting down [364.547908] Shutting down platform ... [364.551416] reboot: Restarting system with command 'recovery' �[0000.201] [platformBoot] (version 24.00.2015.42-mobile-6211a147) [0000.207] Processing in cold boot mode Bootloader 2 [0000.211] A01Q Bootrom Patch rev = 3 [0000.215] Power-up reason: software reset [0000.218] No Battery Present [0000.221] RamCode = 0 [0000.223] Platform has Ddr4 type ram [0000.227] max77620 disabling SD1 Remote Sense [0000.231] Setting Ddr voltage to 1125mv [0000.235] Serial Number of Pmic Max77663: 0x1305f0 [0000.242] Entering ramdump check [0000.245] Get RamDumpCarveOut = 0xff23f000 [0000.249] RamDumpCarveOut=0xff23f000, RamDumperFlag=0xf000caf3 [0000.255] Last reboot was clean, booting normally! [0000.260] Sdram initialization is successful [0000.264] SecureOs Carveout Base=0xff800000 Size=0x00800000 [0000.269] GSC1 Carveout Base=0xff700000 Size=0x00100000 [0000.275] GSC2 Carveout Base=0xff600000 Size=0x00100000 [0000.280] GSC3 Carveout Base=0xff500000 Size=0x00100000 [0000.285] GSC4 Carveout Base=0xff400000 Size=0x00100000 [0000.290] GSC5 Carveout Base=0xff300000 Size=0x00100000 [0000.295] BpmpFw Carveout Base=0xff2c0000 Size=0x00040000 [0000.300] Lp0 Carveout Base=0xff2bf000 Size=0x00001000 [0000.316] RamDump Carveout Base=0xff23f000 Size=0x00080000 [0000.321] Platform-DebugCarveout: 0 [0000.324] Nck Carveout Base=0xff03f000 Size=0x00200000 [0000.460] Using GPT Secondary to query partitions [0000.465] GPT: Partition NOT found ! [0000.468] Find Partition via GPT Failed [0000.472] Find Partition via PT Failed [0000.475] function NvTbootGetBinaryOffsets: 0x1 error [0000.480] Error in NvTbootLoadBinary: 0x1 ! [0000.484] Load RPB failed, skip RPB. * * * here is multiline used in filebeat.yml: multiline.pattern: '[\s+\d+.\d+] ERROR: kso set failed retry: 0(.\*\n){10}' multiline.negate: false multiline.match: after If i ran it gives one line before or after of pattern is matched. ---
**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\ **Post date:** [June 21, 2018, 6:40am UTC](https://discuss.elastic.co/t/how-to-get-10-before-and-after-lines-if-pattern-is-matched-in-multiline-in-filebeat/136689/2 "2018-06-21T06:40:18Z")
Could you show an example of what should be a multiline message in case of the input you shared? ---
**Author:** ![RameshNagargoje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rameshnagargoje/32/30212_2.png) [@RameshNagargoje](https://discuss.elastic.co/u/RameshNagargoje)\ **Post date:** [June 22, 2018, 5:16am UTC](https://discuss.elastic.co/t/how-to-get-10-before-and-after-lines-if-pattern-is-matched-in-multiline-in-filebeat/136689/3 "2018-06-22T05:16:48Z")
@kvch, Here is expected output. multiline should match ERROR: kso set failed retry: 0 and add previous and next at least 5 lines [359.388507] Freezing user space processes ... (elapsed 0.001 seconds) done. [359.397247] nvdumper: rebooting cleanly. [359.401215] nvdumper: set\_dirty\_state 0xf000caf3 [359.420890] sd 0:0:0:0: [sda] Synchronizing SCSI cache [359.440732] therm-fan-est: shutting down [359.445004] wifi\_platform\_set\_power = 0 [359.449696] gk20a gpu.0: shutting down [360.981636] dhdsdio\_clk\_kso\_enab\> op:KSO\_SET, ERROR: try\_cnt:3, rd\_val:ff, ERR:ffffffdd [360.989875] [spoiler] **ERROR: kso set failed retry: 0** [360.998099] dhdsdio\_clk\_devsleep\_iovar: Sleep request failed: kso:0 on:0 err:-35 [361.005905] dhdsdio\_dpc: FAILEDnewstatusREAD, LINE 5987 [361.013201] dhdsdio\_dpc: failed backplane access over SDIO, halting operation [364.459721] gk20a gpu.0: gk20a\_pmu\_save\_zbc: ZBC save timeout [364.466240] gk20a gpu.0: shut down complete [364.516048] late\_shutdown started [364.519364] platform-i2c 7000d100.i2c: Shutting down [364.524078] platform-i2c 7000d000.i2c: Shutting down ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 20, 2018, 5:16am UTC](https://discuss.elastic.co/t/how-to-get-10-before-and-after-lines-if-pattern-is-matched-in-multiline-in-filebeat/136689/4 "2018-07-20T05:16:53Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.