# Incorrect multiline flag detected
**URL:** https://discuss.elastic.co/t/incorrect-multiline-flag-detected/205529
**Category:** Beats
**Tags:** filebeat
**Created:** [October 28, 2019, 6:18pm UTC](https://discuss.elastic.co/t/incorrect-multiline-flag-detected/205529 "2019-10-28T18:18:53Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@madjohnw](https://discuss.elastic.co/u/madjohnw)
#### Post date: [October 28, 2019, 6:18pm UTC](https://discuss.elastic.co/t/incorrect-multiline-flag-detected/205529/1 "2019-10-28T18:18:53Z")
I am adding SQL Server error log files to logstash using filebeat. Some of the log entries are getting combined into a single event, even though they are on separate lines on the log file. The only difference I can see if that the concatenated logs have \r\n in the JSON, while the end of the message only has \r. I have tried using filebeat multiline settings, but what I need is really the opposite.
```
"message": "2019-10-28 13:56:59.17 Backup Database backed up. Database: master, creation date(time): 2019/08/19(22:56:18), pages dumped: 467, first LSN: 354:405:73, last LSN: 354:436:1, number of dump devices: 1, device information: (FILE=1, TYPE=DISK: {'\\\\cdlenc1nasv1\\sqlbackup\\Backup1\\ROSQC14\\master_backup_2019_10_28_135659_0199173.bak'}). This is an informational message only. No user action is required.\r\n2019-10-28 13:56:59.18 Backup BACKUP DATABASE successfully processed 458 pages in 0.048 seconds (74.534 MB/sec).\r\n2019-10-28 13:56:59.28 Backup Database backed up. Database: model, creation date(time): 2003/04/08(09:13:36), pages dumped: 291, first LSN: 37:154:37, last LSN: 37:171:1, number of dump devices: 1, device information: (FILE=1, TYPE=DISK: {'\\\\cdlenc1nasv1\\sqlbackup\\Backup1\\ROSQC14\\model_backup_2019_10_28_135659_0199173.bak'}). This is an informational message only. No user action is required.\r\n2019-10-28 13:56:59.30 Backup BACKUP DATABASE successfully processed 282 pages in 0.031 seconds (70.832 MB/sec).\r\n2019-10-28 13:56:59.59 Backup Database backed up. Database: msdb, creation date(time): 2012/02/10(21:02:17), pages dumped: 7826, first LSN: 17961:16:129, last LSN: 17961:71:1, number of dump devices: 1, device information: (FILE=1, TYPE=DISK: {'\\\\cdlenc1nasv1\\sqlbackup\\Backup1\\ROSQC14\\msdb_backup_2019_10_28_135659_0199173.bak'}). This is an informational message only. No user action is required.\r\n2019-10-28 13:56:59.61 Backup BACKUP DATABASE successfully processed 7756 pages in 0.185 seconds (327.510 MB/sec).\r",
```
---
### Author:  [@madjohnw](https://discuss.elastic.co/u/madjohnw)
#### Post date: [October 28, 2019, 6:20pm UTC](https://discuss.elastic.co/t/incorrect-multiline-flag-detected/205529/2 "2019-10-28T18:20:03Z")
I have also tried using the line\_terminator setting in filebeat.yml, but it does not seem to change the issue.
---
### Author:  [@madjohnw](https://discuss.elastic.co/u/madjohnw)
#### Post date: [October 29, 2019, 1:15am UTC](https://discuss.elastic.co/t/incorrect-multiline-flag-detected/205529/3 "2019-10-29T01:15:45Z")
I believe this is due to the log entries having timestamps that are either the same or just a few seconds apart. I tested this with several events, and it look like anything less than 10 seconds apart on the log gets treated as the same event. Is there a way to change a config setting to address this issue?
---
### Author:  [@kvch](https://discuss.elastic.co/u/kvch)
#### Post date: [October 29, 2019, 10:48am UTC](https://discuss.elastic.co/t/incorrect-multiline-flag-detected/205529/4 "2019-10-29T10:48:39Z")
How do you want to concatenate/split your events? How did you change `line_terminator` settings exactly?
Filebeat is only able to split lines along one terminator. If you want to split messages both at `\r\n` and `\n`, I suggest you do the second splitting in Logstash.
---
### Author:  [@madjohnw](https://discuss.elastic.co/u/madjohnw)
#### Post date: [October 29, 2019, 1:01pm UTC](https://discuss.elastic.co/t/incorrect-multiline-flag-detected/205529/5 "2019-10-29T13:01:05Z")
I just want to have each log entry be a separate event. I tried all of the options for line\_terminator in filebeat.yml (carriage\_return, carriage\_return\_line\_feed, etc.)
I did attempt to manipulate the message in logstash, but I don't know how to separate parts of a single message into multiple events. If there is an example on how to do that I will give it a try.
Thanks!
---
### Author:  [@madjohnw](https://discuss.elastic.co/u/madjohnw)
#### Post date: [October 30, 2019, 2:35pm UTC](https://discuss.elastic.co/t/incorrect-multiline-flag-detected/205529/6 "2019-10-30T14:35:19Z")
Solved the issue by replacing the newline characters with a tilde and then with a split in logstash.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 27, 2019, 2:35pm UTC](https://discuss.elastic.co/t/incorrect-multiline-flag-detected/205529/7 "2019-11-27T14:35:23Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.