# Mulitline pattern in docker autodiscover

**URL:** <https://discuss.elastic.co/t/mulitline-pattern-in-docker-autodiscover/267647>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 18, 2021, 11:43am UTC](https://discuss.elastic.co/t/mulitline-pattern-in-docker-autodiscover/267647 "2021-03-18T11:43:32Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![d01](https://avatars.discourse-cdn.com/v4/letter/d/c67d28/32.png) [@d01](https://discuss.elastic.co/u/d01)\
**Post date:** [March 18, 2021, 11:43am UTC](https://discuss.elastic.co/t/mulitline-pattern-in-docker-autodiscover/267647/1 "2021-03-18T11:43:32Z")

</div>

I have the following logs coming from a docker container:

```auto
    2021-03-17T13:43:43+0000 DEBUG [__main__.<module>] Debug
    2021-03-17T13:43:43+0000 INFO [__main__.<module>] Info
    2021-03-17T13:43:43+0000 WARNING [__main__.<module>] Warn
    2021-03-17T13:43:43+0000 ERROR [__main__.<module>] Error
    2021-03-17T13:43:43+0000 ERROR [__main__.<module>] Exception
    Traceback (most recent call last):
      File "test.py", line 45, in <module>
        raise Exception("Test")
    Exception: Test
    2021-03-17T13:43:43+0000 CRITICAL [__main__.<module>] Critical
    2021-03-17T13:43:58+0000 DEBUG [__main__.<module>] Debug
    2021-03-17T13:43:58+0000 INFO [__main__.<module>] Info
    2021-03-17T13:43:58+0000 WARNING [__main__.<module>] Warn
    2021-03-17T13:43:58+0000 ERROR [__main__.<module>] Error
    2021-03-17T13:43:58+0000 ERROR [__main__.<module>] Exception

```

I can parse the sections (time, log level, logger and message) just fine with logstash, the problem is the multiline exception. From what I have gathered, this should not occur in logstash, but rather filebeat.  
I am using autodiscover with type hints to handle several different applications:

```auto
    filebeat:
      config:
        modules:
          path: ${path.config}/modules.d/*.yml
          reload.enabled: false

      autodiscover:
        providers:
          - type: docker
            hints.enabled: true

```

I have tried using templates here, but to no avail:

```auto
    filebeat:
      config:
        modules:
          path: ${path.config}/modules.d/*.yml
          reload.enabled: false

      autodiscover:
        providers:
          - type: docker
            hints.enabled: true
            templates:
              - condition:
                  contains:
                    docker.container.name: "test"
                config:
                  - input_type: container
                    combine_partial: true
                    multiline.pattern: '^\d\d\d\d-\d\d-\d\d'
                    multiline.negate: true
                    multiline.match: after

```

With this config for example it stops sending logs to logstash all together

---

<div class="post-metadata">

**Author:** ![shaunak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shaunak/32/6643_2.png) [@shaunak](https://discuss.elastic.co/u/shaunak)\
**Post date:** [March 18, 2021, 8:50pm UTC](https://discuss.elastic.co/t/mulitline-pattern-in-docker-autodiscover/267647/2 "2021-03-18T20:50:42Z")

</div>

I think you are on the right track with using templates. But `input_type: container` looks incorrect to me. I think it should be just `type: container`.

Shaunak

---

<div class="post-metadata">

**Author:** ![d01](https://avatars.discourse-cdn.com/v4/letter/d/c67d28/32.png) [@d01](https://discuss.elastic.co/u/d01)\
**Post date:** [March 19, 2021, 11:06am UTC](https://discuss.elastic.co/t/mulitline-pattern-in-docker-autodiscover/267647/3 "2021-03-19T11:06:39Z")

</div>

Thank you, but sadly no change with

```auto
filebeat:
  config:
    modules:
      path: ${path.config}/modules.d/*.yml
      reload.enabled: false

  autodiscover:
    providers:
      - type: docker
        hints.enabled: true
        templates:
          - condition:
              contains:
                docker.container.name: "test"
            config:
              - type: container
                combine_partial: true
                multiline.pattern: '^\d\d\d\d-\d\d-\d\d'
                multiline.negate: true
                multiline.match: after

```

As previously it stops sending logs from this container to logstash (I have a stdout{} there). Meanwhile filebeat does not log any problems or anything for that matter..

Can I try something else? Or get you some specific information from filebeat?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 16, 2021, 1:07pm UTC](https://discuss.elastic.co/t/mulitline-pattern-in-docker-autodiscover/267647/4 "2021-04-16T13:07:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.