# In what order are the options processed

**URL:** <https://discuss.elastic.co/t/in-what-order-are-the-options-processed/39341>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [January 15, 2016, 3:40pm UTC](https://discuss.elastic.co/t/in-what-order-are-the-options-processed/39341 "2016-01-15T15:40:13Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Aron\_Pedersen](https://avatars.discourse-cdn.com/v4/letter/a/8491ac/32.png) [@Aron\_Pedersen](https://discuss.elastic.co/u/Aron_Pedersen)\
**Post date:** [January 15, 2016, 3:40pm UTC](https://discuss.elastic.co/t/in-what-order-are-the-options-processed/39341/1 "2016-01-15T15:40:14Z")

</div>

Is the the Multiline option run before or after the Exclude/Include option? What I would like to do is to combine lines first and then after this either Include or Exclude these combined lines.

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [January 15, 2016, 4:02pm UTC](https://discuss.elastic.co/t/in-what-order-are-the-options-processed/39341/2 "2016-01-15T16:02:52Z")

</div>

lines are combined into multiline events first. Only full events are filtered by Exclude/lines options (filtering happens after multiline).

---

<div class="post-metadata">

**Author:** ![Aron\_Pedersen](https://avatars.discourse-cdn.com/v4/letter/a/8491ac/32.png) [@Aron\_Pedersen](https://discuss.elastic.co/u/Aron_Pedersen)\
**Post date:** [January 15, 2016, 4:54pm UTC](https://discuss.elastic.co/t/in-what-order-are-the-options-processed/39341/3 "2016-01-15T16:54:41Z")

</div>

Thank you Steffen.  
One more observation. When I use the "filebeat -version" command (on a Windows 2012 R2 Server) for the filebeat.exe included in the filebeat-1.1.0-nightlylatest-windows.zip it report version 1.0.0 (386)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 9:56pm UTC](https://discuss.elastic.co/t/in-what-order-are-the-options-processed/39341/4 "2017-07-05T21:56:39Z")

</div>