# Missing events while using Filebeat multiline.flush\_pattern

**URL:** https://discuss.elastic.co/t/missing-events-while-using-filebeat-multiline-flush-pattern/279175
**Category:** Beats
**Tags:** filebeat
**Created:** [July 20, 2021, 2:39pm UTC](https://discuss.elastic.co/t/missing-events-while-using-filebeat-multiline-flush-pattern/279175 "2021-07-20T14:39:27Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![bhavaniprasad\_reddy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bhavaniprasad_reddy/32/52086_2.png) [@bhavaniprasad\_reddy](https://discuss.elastic.co/u/bhavaniprasad_reddy)
#### Post date: [July 20, 2021, 2:39pm UTC](https://discuss.elastic.co/t/missing-events-while-using-filebeat-multiline-flush-pattern/279175/1 "2021-07-20T14:39:27Z")

</div>

Filebeat "multiline.flush\_pattern" is flushing the multiline line event starting with "multiline.pattern" and ending with "multiline.flush\_pattern".

I am facing 2 issues with multiline.flush\_pattern,

1. The lines after "multiline.flush\_pattern" are not stored in elasticsearch. I do not see those lines even in the filebeat debug logs.
2. I expect the events that are not matching with multiline.flush\_pattern to be stored in the elasticsearch but I do not see any of them in elasticsearch or in the filebeat debug logs

filebeat configuration-

```auto
config:
   - type: container
     paths:
       - "/var/log/containers/*-${data.kubernetes.container.id}.log"
     multiline.type: pattern
     multiline.pattern: '^Received Parameters: request_data - {.*}$'
     multiline.negate: true
     multiline.match: after
     multiline.flush_pattern: '^-I- DONE 1$'

```

My logfile actually starts with "Received Parameters: request\_data - " and ends with a few more lines after "-I- DONE 1".

Please help me to find the cause of the issue and let me know if you need any more details.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 17, 2021, 4:40pm UTC](https://discuss.elastic.co/t/missing-events-while-using-filebeat-multiline-flush-pattern/279175/2 "2021-08-17T16:40:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
