# Logstash not picking up multiline logs

**URL:** <https://discuss.elastic.co/t/logstash-not-picking-up-multiline-logs/250823>\
**Category:** Logstash\
**Created:** [October 2, 2020, 4:47pm UTC](https://discuss.elastic.co/t/logstash-not-picking-up-multiline-logs/250823 "2020-10-02T16:47:29Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ayesha](https://avatars.discourse-cdn.com/v4/letter/a/c0e974/32.png) [@Ayesha](https://discuss.elastic.co/u/Ayesha)\
**Post date:** [October 2, 2020, 4:47pm UTC](https://discuss.elastic.co/t/logstash-not-picking-up-multiline-logs/250823/1 "2020-10-02T16:47:29Z")

</div>

Hi,

I am parsing a log file which has both multiline and singleline logs in it.  
Here is a sample data

```
13-08-2020 11:15:41,278 DEBUG [org.jboss.as.config] (MSC service thread 1-7) Configured system properties:
	[Standalone] = 
	awt.toolkit = sun.awt.X11.XToolkit
13-08-2020 11:16:00,750 INFO [org.jboss.as.connector.deployers.jdbc] (MSC service thread 1-1) WFLYJCA0004: Deploying JDBC-compliant driver class oracle.jdbc.OracleDriver (version 11.2)
13-08-2020 11:16:00,751 INFO [org.jboss.as.connector.deployers.jdbc] (MSC service thread 1-1) WFLYJCA0004: Deploying JDBC-compliant driver class oracle.jdbc.OracleDriver (version 11.2)

```

I added below lines in my filebeat.yml file (Didn't add the codec in logstash because cannot add it under beats)

multiline.type: pattern  
multiline.pattern: '^\s?[0-9]{2}-[0-9]{2}-[0-9]{4}'  
multiline.negate: true (I tried false as well, didn't work)  
multiline.match: after

 ![Filebeat error](https://us1.discourse-cdn.com/elastic/original/3X/e/a/ea4c3848cd7286263d45b5e7f026becdb7a8f989.jpeg)

The Grok pattern I am using inside logstash conf file is below

`%{DATE:Date} %{TIME:Time} %{LOGLEVEL:LogLevel} \[%{GREEDYDATA:Provider}\] \(%{GREEDYDATA:Thread}\) %{GREEDYDATA:Message}`

Any help would be greatly appreciated.  
Thanks in advanceThis text will be hidden

---

<div class="post-metadata">

**Author:** ![Ayesha](https://avatars.discourse-cdn.com/v4/letter/a/c0e974/32.png) [@Ayesha](https://discuss.elastic.co/u/Ayesha)\
**Post date:** [October 6, 2020, 8:57am UTC](https://discuss.elastic.co/t/logstash-not-picking-up-multiline-logs/250823/2 "2020-10-06T08:57:24Z")

</div>

My issue got resolved. I had to move multiline.pattern from filebeat.tml to the in config as I was using configs.

> <https://github.com/elastic/beats/issues/11863>
>
> Per my report in discussion forums it appears that any multi-line pattern added in the main filebeat.yml file is ignored when...

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 3, 2020, 8:57am UTC](https://discuss.elastic.co/t/logstash-not-picking-up-multiline-logs/250823/3 "2020-11-03T08:57:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.