# How to make multiline to work when deploy filebeat to openshift 3.11

**URL:** <https://discuss.elastic.co/t/how-to-make-multiline-to-work-when-deploy-filebeat-to-openshift-3-11/284858>\
**Category:** Beats\
**Tags:** docker, filebeat\
**Created:** [September 22, 2021, 11:30am UTC](https://discuss.elastic.co/t/how-to-make-multiline-to-work-when-deploy-filebeat-to-openshift-3-11/284858 "2021-09-22T11:30:46Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![lsy1990](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lsy1990/32/94742_2.png) [@lsy1990](https://discuss.elastic.co/u/lsy1990)\
**Post date:** [September 22, 2021, 11:30am UTC](https://discuss.elastic.co/t/how-to-make-multiline-to-work-when-deploy-filebeat-to-openshift-3-11/284858/1 "2021-09-22T11:30:46Z")

</div>

I deploy filebeat to openshift 3.11.  
the log is json format like this :

{"log":"W0922 10:48:03.257983 1 reflector.go:341] [github.com/kubernetes-incubator/external-storage/lib/controller/controller.go:668:](http://github.com/kubernetes-incubator/external-storage/lib/controller/controller.go:668:) watch of \*v1.StorageClass ended with: The resourceVersion for the provided watch is too old.\n","stream":"stderr","time":"2021-09-22T10:48:03.258127725Z"}  
{"log":"W0922 10:52:30.614798 1 reflector.go:341] [github.com/kubernetes-incubator/external-storage/lib/controller/controller.go:665:](http://github.com/kubernetes-incubator/external-storage/lib/controller/controller.go:665:) watch of \*v1.PersistentVolume ended with: The resourceVersion for the provided watch is too old.\n","stream":"stderr","time":"2021-09-22T10:52:30.614938249Z"}

and my config filebeat.yml is below:  
inputs:  
path: ${path.config}/inputs.d/_.yml  
reload.enabled: false  
modules:  
path: ${path.config}/modules.d/_.yml  
reload.enabled: false

filebeat.autodiscover:  
providers:  
- type: kubernetes  
include\_pod\_uid: true  
hints.enabled: true  
templates:  
- condition.regexp:  
kubernetes.container.name: '.+'  
config:  
- type: docker  
containers:  
path: "/var/log/pods/\*${data.kubernetes.pod.uid}/"  
ids:  
- "${data.kubernetes.container.name}"  
multiline.pattern: '^[[:space:]]'  
multiline.negate: false  
multiline.match: after  
processors:  
- decode\_json\_fields:  
process\_array: true  
max\_depth: 10  
target: ""  
overwrite\_keys: true  
fields: ["message"]

processors:

- add\_cloud\_metadata:
- drop\_event:  
when:  
equals:  
kubernetes.container.name: "filebeat"
- drop\_event:  
when:  
regexp:  
message: "^DBG:"

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 20, 2021, 1:30pm UTC](https://discuss.elastic.co/t/how-to-make-multiline-to-work-when-deploy-filebeat-to-openshift-3-11/284858/2 "2021-10-20T13:30:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.