# Ingest pipe line csv parser with multiline message failing

**URL:** https://discuss.elastic.co/t/ingest-pipe-line-csv-parser-with-multiline-message-failing/260666
**Category:** Beats
**Tags:** filebeat, ingest-pipeline
**Created:** [January 11, 2021, 4:18am UTC](https://discuss.elastic.co/t/ingest-pipe-line-csv-parser-with-multiline-message-failing/260666 "2021-01-11T04:18:00Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![Bo\_Koralage](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bo_koralage/32/81539_2.png) [@Bo\_Koralage](https://discuss.elastic.co/u/Bo_Koralage)
#### Post date: [January 11, 2021, 4:18am UTC](https://discuss.elastic.co/t/ingest-pipe-line-csv-parser-with-multiline-message-failing/260666/1 "2021-01-11T04:18:00Z")

</div>

I am using a csv processor and \t as the separator ingest pipeline to push logs from filebeat. This works great but fails when the message (logmessage) portion has a new line character. I added the following to the filebeat.yml to deal with multiline but hasn't helped. Loglines start with a TS like 2020-12-29T08:25:01.971....

Any help would be great?

filebeat.yml  
multiline.type: pattern  
multiline.pattern: '^20'  
multiline.match: after  
multiline.negate: true

pipeline def

Copy to clipboard

```auto
  "pipeline_tab" : {
    "description" : "tab pattern",
    "processors" : [
      {
        "csv" : {
          "field" : "message",
          "target_fields" : [
            "timestamp",
            "relativeTime",
            "thread",
            "processName",
            "sourceName",
            "logType",
            "logMessage"
          ],
          "separator" : "\t"
        }
      }
    ]
  }

```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 8, 2021, 6:18am UTC](https://discuss.elastic.co/t/ingest-pipe-line-csv-parser-with-multiline-message-failing/260666/2 "2021-02-08T06:18:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.