# Multi-line Filebeat templates don't work with filebeat.inputs - type: filestream

**URL:** <https://discuss.elastic.co/t/multi-line-filebeat-templates-dont-work-with-filebeat-inputs-type-filestream/274510>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 31, 2021, 1:19pm UTC](https://discuss.elastic.co/t/multi-line-filebeat-templates-dont-work-with-filebeat-inputs-type-filestream/274510 "2021-05-31T13:19:57Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![cva](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cva/32/85514_2.png) [@cva](https://discuss.elastic.co/u/cva)\
**Post date:** [May 31, 2021, 1:19pm UTC](https://discuss.elastic.co/t/multi-line-filebeat-templates-dont-work-with-filebeat-inputs-type-filestream/274510/1 "2021-05-31T13:19:57Z")

</div>

I ran into a multiline processing problem in Filebeat when the filebeat.inputs: parameters specify type: filestream - the logs of the file stream are not analyzed according to the requirements of multiline. pattern: '^[[0-9]{4}-[0-9]{2}-[0-9]{2}', in the output, I see that the lines are not added to the lines, are created new single-line messages with individual lines from the log file.

If you specify type: log in the file bat.inputs: parameters, then everything works correctly, in accordance with the requirements of multiline. pattern: '^[[0-9]{4}-[0-9]{2}-[0-9]{2}' - a multiline message is created.

What is not correctly specified in my config?

```auto
       filebeat.inputs:
 
     - type: filestream
 
       enabled: true
 
       paths:
         - C:\logs\GT\TTL\*\*.log
       fields_under_root: true
       fields:
         instance: xml
         system: ttl
         subsystem: GT
         account: abc
       multiline.type: pattern
       multiline.pattern: '^\[[0-9]{4}-[0-9]{2}-[0-9]{2}'
       multiline.negate: true
       multiline.match: after

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 28, 2021, 3:20pm UTC](https://discuss.elastic.co/t/multi-line-filebeat-templates-dont-work-with-filebeat-inputs-type-filestream/274510/2 "2021-06-28T15:20:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

---

<div class="post-metadata">

**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\
**Post date:** [December 9, 2021, 6:06pm UTC](https://discuss.elastic.co/t/multi-line-filebeat-templates-dont-work-with-filebeat-inputs-type-filestream/274510/3 "2021-12-09T18:06:07Z")

</div>

Hey @cva,

Sorry for not replying before.

As commented in [Multiline does not work in Filebeat 7.16 filestream inputs · Issue #29361 · elastic/beats · GitHub](https://github.com/elastic/beats/issues/29361), the solution for this would be to use parsers, as described here: [filestream input | Filebeat Reference [7.16] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/7.16/filebeat-input-filestream.html#_parsers)