# Java multiline with add\_docker\_metadata

**URL:** <https://discuss.elastic.co/t/java-multiline-with-add-docker-metadata/130860>\
**Category:** Beats\
**Created:** [May 7, 2018, 3:38pm UTC](https://discuss.elastic.co/t/java-multiline-with-add-docker-metadata/130860 "2018-05-07T15:38:17Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![mimmus](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mimmus/32/34273_2.png) [@mimmus](https://discuss.elastic.co/u/mimmus)\
**Post date:** [May 7, 2018, 3:38pm UTC](https://discuss.elastic.co/t/java-multiline-with-add-docker-metadata/130860/1 "2018-05-07T15:38:17Z")

</div>

We are using this:

> **[Enriching logs with Docker metadata using Filebeat](https://www.elastic.co/blog/enrich-docker-logs-with-filebeat)**
>
> Filebeat can now ship Docker logs and enrich them with metadata to make navigating them easier.

  
and now we are trying to configure multiline to fetch Java stacktrace as a single message but any attempt fails.  
We are pretty sure that patterns used to identify multiline are OK.  
Is it possible to use multiline with Docker json logs?

---

<div class="post-metadata">

**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\
**Post date:** [May 7, 2018, 7:52pm UTC](https://discuss.elastic.co/t/java-multiline-with-add-docker-metadata/130860/2 "2018-05-07T19:52:51Z")

</div>

Can you share your filebeat config?

---

<div class="post-metadata">

**Author:** ![mimmus](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mimmus/32/34273_2.png) [@mimmus](https://discuss.elastic.co/u/mimmus)\
**Post date:** [May 8, 2018, 8:13am UTC](https://discuss.elastic.co/t/java-multiline-with-add-docker-metadata/130860/3 "2018-05-08T08:13:31Z")

</div>

Actually, I'm getting some kind of aggregation but also a lot of single lines, I don't understand the reason

```
filebeat.modules:
- module: kafka

filebeat.prospectors:
- type: log
  paths:
    - '/var/lib/docker/containers/*/*.log'
  json.message_key: log
  json.keys_under_root: true
  multiline.pattern: '^MSG|WNG|ERR'
  multiline.negate: true
  multiline.match: after
  tail_files: true
  processors:
  - add_docker_metadata: ~

setup.kibana:
  host: "plogelk06.mydomain.com:5601"

output.kafka:
  hosts: ["plogelk01:9092", "plogelk02:9092", "plogelk03:9092"]
  codec.format:
    string: 'beat=%{[beat]} message=%{[log]}'
  topic: 'test_svil_filebeat'
  partition.round_robin:
    reachable_only: false
  required_acks: 1
  compression: gzip
  max_message_bytes: 1000000
```

I can send you also some log lines but better privately as it is not easy to "anonymize".

Thanks

---

<div class="post-metadata">

**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\
**Post date:** [May 8, 2018, 8:27am UTC](https://discuss.elastic.co/t/java-multiline-with-add-docker-metadata/130860/4 "2018-05-08T08:27:12Z")

</div>

Yes please, send me those logs as a private message

---

<div class="post-metadata">

**Author:** ![mimmus](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mimmus/32/34273_2.png) [@mimmus](https://discuss.elastic.co/u/mimmus)\
**Post date:** [May 8, 2018, 8:45am UTC](https://discuss.elastic.co/t/java-multiline-with-add-docker-metadata/130860/5 "2018-05-08T08:45:55Z")

</div>

Please accept my apologies: I had TWO filebeat containers running at same moment, with different configs!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 5, 2018, 10:49am UTC](https://discuss.elastic.co/t/java-multiline-with-add-docker-metadata/130860/6 "2018-06-05T10:49:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.