# Merge Multiple Line Event Messages in Elastic through Filebeat

**URL:** https://discuss.elastic.co/t/merge-multiple-line-event-messages-in-elastic-through-filebeat/361448
**Category:** Beats
**Tags:** filebeat
**Created:** [June 13, 2024, 8:53pm UTC](https://discuss.elastic.co/t/merge-multiple-line-event-messages-in-elastic-through-filebeat/361448 "2024-06-13T20:53:52Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![nitesh.srivastava](https://avatars.discourse-cdn.com/v4/letter/n/278dde/32.png) [@nitesh.srivastava](https://discuss.elastic.co/u/nitesh.srivastava)
#### Post date: [June 13, 2024, 8:53pm UTC](https://discuss.elastic.co/t/merge-multiple-line-event-messages-in-elastic-through-filebeat/361448/1 "2024-06-13T20:53:52Z")

</div>

Hi All,

We have a situation where we are monitoring some server syslogs using Filebeat/Logstash and we want log messages in multiple lines to show up as a single event in Elastic instead of an event for each line.  
I checked this link [Manage multiline messages | Filebeat Reference [8.14] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html) and it does talk about handling the multiple line events by making a change in the filebeat.yml file. I tried this config settings with no luck. Can you please help me with the issue

Below is the example from the syslog. It has the SQL execution time and SQL ID in different lines and we want them to show up in one event in Elastic.  
_=========================================================_  
_INFO - 2024/06/04-10:18:33.522 UTC - UTCLAP70Y23Z2.18098.01.poznantx.00481.Mux.Svr - ===\>Took 2891.968 seconds to execute that SQL (returning 40328570 rows) - ABC.POM at /scratch/yytcadm/abc142072023080300\_502239ln/src/foundation/pom/eim/log/ExplainPlan.cxx(302)_  
_Execution Plan:_  
_SQL\_ID ABCDEFGHIJK, child number 0_

================================================

And, Below is my filebeat.yml config :  
_# ============================== Filebeat inputs ===============================_

_filebeat.inputs:_  
_parsers:_  
_- multiline:_

- type: pattern\*
- pattern: '^INFO'\*
- negate: true\*
- match: after\*

_# Each - is an input. Most options can be set at the input level, so_  
_# you can use different inputs for various configurations._  
_# Below are the input-specific configurations._

_# filestream is an input for collecting log messages from files._

- type: filestream  
====================================================

---

<div class="post-metadata">

### Author: ![yago82](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yago82/32/97755_2.png) [@yago82](https://discuss.elastic.co/u/yago82)
#### Post date: [June 14, 2024, 11:47am UTC](https://discuss.elastic.co/t/merge-multiple-line-event-messages-in-elastic-through-filebeat/361448/2 "2024-06-14T11:47:48Z")

</div>

Hi,

try with this:

```auto
filebeat.inputs:
- type: filestream
  paths:
    - /path/to/your/logs/*.log
  parsers:
    - multiline:
        type: pattern
        pattern: '^INFO'
        negate: true
        match: after

```

Regards

---

<div class="post-metadata">

### Author: ![nitesh.srivastava](https://avatars.discourse-cdn.com/v4/letter/n/278dde/32.png) [@nitesh.srivastava](https://discuss.elastic.co/u/nitesh.srivastava)
#### Post date: [June 14, 2024, 9:32pm UTC](https://discuss.elastic.co/t/merge-multiple-line-event-messages-in-elastic-through-filebeat/361448/3 "2024-06-14T21:32:11Z")

</div>

Thank you @yago82 this was very helpful. I just gave it a try and voila it started working like a charm.  
Thanks a bunch for your input!!! Much Appreciated 🙂