# If filebeat is deployed with single instance then no issue is observed in multiline handling. If Filebeat is deployed with daemonset then all events does not follow proper multiline pattern thus results in individual events. Is there any bug reported? **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [August 29, 2022, 9:07am UTC](https://discuss.elastic.co/t/if-filebeat-is-deployed-with-single-instance-then-no-issue-is-observed-in-multiline-handling-if-filebeat-is-deployed-with-daemonset-then-all-events-does-not-follow-proper-multiline-pattern-thus-results-in-individual-events-is-there-any-bug-reported/313141 "2022-08-29T09:07:22Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Chitra1](https://avatars.discourse-cdn.com/v4/letter/c/d2c977/32.png) [@Chitra1](https://discuss.elastic.co/u/Chitra1)\ **Post date:** [August 29, 2022, 9:07am UTC](https://discuss.elastic.co/t/if-filebeat-is-deployed-with-single-instance-then-no-issue-is-observed-in-multiline-handling-if-filebeat-is-deployed-with-daemonset-then-all-events-does-not-follow-proper-multiline-pattern-thus-results-in-individual-events-is-there-any-bug-reported/313141/1 "2022-08-29T09:07:22Z")
If filebeat is deployed with single instance then no issue is observed in multiline handling. If Filebeat is deployed with daemonset then all events does not follow proper multiline pattern thus results in individual events. Is there any bug reported ? ---
**Author:** ![MichelLaterman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/michellaterman/32/110221_2.png) [@MichelLaterman](https://discuss.elastic.co/u/MichelLaterman)\ **Post date:** [September 1, 2022, 7:16pm UTC](https://discuss.elastic.co/t/if-filebeat-is-deployed-with-single-instance-then-no-issue-is-observed-in-multiline-handling-if-filebeat-is-deployed-with-daemonset-then-all-events-does-not-follow-proper-multiline-pattern-thus-results-in-individual-events-is-there-any-bug-reported/313141/2 "2022-09-01T19:16:33Z")
Issues and bug reports are handled through the beats github repo: [Issues · elastic/beats · GitHub](https://github.com/elastic/beats/issues) Can you provide any details on how filebeat is deployed and configured? ---
**Author:** ![Chitra1](https://avatars.discourse-cdn.com/v4/letter/c/d2c977/32.png) [@Chitra1](https://discuss.elastic.co/u/Chitra1)\ **Post date:** [September 2, 2022, 7:37am UTC](https://discuss.elastic.co/t/if-filebeat-is-deployed-with-single-instance-then-no-issue-is-observed-in-multiline-handling-if-filebeat-is-deployed-with-daemonset-then-all-events-does-not-follow-proper-multiline-pattern-thus-results-in-individual-events-is-there-any-bug-reported/313141/3 "2022-09-02T07:37:46Z")
Filebeat config looks like this filebeat-container.yml: |2 filebeat.inputs: - type: log paths: [/opt/abc/myfile.log] multiline.pattern: \[1\] multiline.negate: true multiline.match: after output.kafka: hosts: ${KAFKA\_HOST} topic: myfilelogs compression: snappy max\_message\_bytes: 1000000 logging.level: debug Log file - [00:00:37] hsdhdjn : xmt/rcv/%loss = 23/23/0%, min/avg/max = 0.249/0.412/2.69 [00:00:44] 240\*\*\*\*\*\*\*\*\*\*\*\*\*\* : xmt/rcv/%loss = 23/23/0%, min/avg/max = 0.249/0.316/0.390 [00:00:51] 240\*\*\*\*\*\*\*\*\*\*\*\*\*\* : xmt/rcv/%loss = 24/24/0%, min/avg/max = 0.260/0.3\*\*/0.5\*\* [00:00:58] 240\*\*\*\*\*\*\*\*\*\*\*\*\*\* : xmt/rcv/%loss = 23/23/0%, min/avg/max = 0.264/0.322/0.412 [00:01:05] 240\*\*\*\*\*\*\*\*\*\*\*\*\*\* : xmt/rcv/%loss = 23/23/0%, min/avg/max = 0.242/0.372/0.859 output on kafka when using deployment - { "@timestamp": "2022-08-30T06:15:51.300Z", "@metadata": { "beat": "filebeat", "type": "\_doc", "version": "8.2.3" }, "log": { "offset": 518535, "file": { "path": "/home/obf/abc/myfile.log" }, "flags": [ "multiline" ] }, "input": { "type": "log" }, "ecs": { "version": "8.0.0" }, "host": { "name": "abc-network-tool-network\*\*\*-0" }, "agent": { "version": "8.2.3", "ephemeral\_id": "_**", "id": "2dc778780", "name": "**_-0", "type": "filebeat" }, "message": "[00:01:05]\n240\*\*\*\*\* : xmt/rcv/%loss = 23/23/0%, min/avg/max = 0.242/0.372/0.859" } output on kafka when using daemonset - { "@timestamp": "2022-08-30T06:15:51.300Z", "@metadata": { "beat": "filebeat", "type": "\_doc", "version": "8.2.3" }, "log": { "offset": 518535, "file": { "path": "/home/obf/abc/myfile.log" } }, "input": { "type": "log" }, "ecs": { "version": "8.0.0" }, "host": { "name": "abc-network-tool-network\*\*\*-0" }, "agent": { "version": "8.2.3", "ephemeral\_id": "_**", "id": "2dc778780", "name": "**_-0", "type": "filebeat" }, "message": "[00:00:58]" } { "@timestamp": "2022-08-30T06:15:51.300Z", "@metadata": { "beat": "filebeat", "type": "\_doc", "version": "8.2.3" }, "log": { "offset": 518536, "file": { "path": "/home/obf/abc/myfile.log" } }, "input": { "type": "log" }, "ecs": { "version": "8.0.0" }, "host": { "name": "abc-network-tool-network\*\*\*-0" }, "agent": { "version": "8.2.3", "ephemeral\_id": "_**", "id": "2dc778780", "name": "**_-0", "type": "filebeat" }, "message": "240\*\*\*\*\*\*\*\*\*\*\*\*\*\* : xmt/rcv/%loss = 23/23/0%, min/avg/max = 0.264/0.322/0.412" } * * * 1. \d{2}:\d{2}:\d{2} ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 30, 2022, 9:38am UTC](https://discuss.elastic.co/t/if-filebeat-is-deployed-with-single-instance-then-no-issue-is-observed-in-multiline-handling-if-filebeat-is-deployed-with-daemonset-then-all-events-does-not-follow-proper-multiline-pattern-thus-results-in-individual-events-is-there-any-bug-reported/313141/4 "2022-09-30T09:38:39Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.