ns1:OriginatorIdWebServices\ ns1:SystemApplicationNameypg.bis.fu…
Thanks.
---
### Author:  [@mtojek](https://discuss.elastic.co/u/mtojek)
#### Post date: [July 29, 2020, 7:25am UTC](https://discuss.elastic.co/t/multi-line-logs-javastack-trace-not-showing-up-correctly/242903/8 "2020-07-29T07:25:52Z")
Archie, please present your configuration too. Remember that you can try your own to adjust it to your log lines using the [https://grokdebug.herokuapp.com/](https://grokdebug.herokuapp.com/)
---
### Author:  [@Archie\_Crawford](https://discuss.elastic.co/u/Archie_Crawford)
#### Post date: [July 29, 2020, 12:00pm UTC](https://discuss.elastic.co/t/multi-line-logs-javastack-trace-not-showing-up-correctly/242903/9 "2020-07-29T12:00:11Z")
```auto
filebeat.inputs:
- type: log
enabled: true
paths:
- /var/log/*.log
- /var/log/*messages*
- /var/log/secure
- /var/apache-tomcat-8.5.23/logs/catalina*
- /var/apache-tomcat-8.5.23/logs/*.log
### Multiline options
# Mutiline can be used for log messages spanning multiple lines. This is common
# for Java Stack Traces or C-Line Continuation
# The regexp Pattern that has to be matched. The example pattern matches all lines starting with [
# multiline.pattern: ^[0-9]{2}-(?:Jan(?:uary)?|Feb(?:ruary)?|Mar(?:ch)?|Apr(?:il)?|May|Jun(?:e)?|Jul(?:y)?|Aug(?:ust)?|Sep(?:tember)?|Sept|Oct(?:ober)?|Nov(?:ember)?|Dec(?:ember)?)-[0-9]{4}
# multiline.pattern: '^[[:space:]]+(at|\.{3})\b|^Caused by:'
#multiline.pattern: ^[0-9]{2}-(?:Jan(?:uary)?|Feb(?:ruary)?|Mar(?:ch)?|Apr(?:il)?|May|Jun(?:e)?|Jul(?:y)?|Aug(?:ust)?|Sep(?:tember)?|Sept|Oct(?:ober)?|Nov(?:ember)?|Dec(?:ember)?)-[0-9]{4}
#multiline.negate: true
#multiline.match: after
multiline.pattern: '^[[:space:]]+(at|\.{3})\b|^Caused by:'
multiline.negate: false
multiline.match: after
filebeat.config.modules:
path: ${path.config}/modules.d/*.yml
reload.enabled: true
setup.template.settings:
index.number_of_shards: 3
setup.kibana:
host: "xxxxx"
output.logstash:
hosts: ["xxxxxx"]
processors:
- add_host_metadata: ~
- add_cloud_metadata: ~
xpack.monitoring.elasticsearch.hosts: ["https://xxxxxx"]
```
---
### Author:  [@Archie\_Crawford](https://discuss.elastic.co/u/Archie_Crawford)
#### Post date: [July 29, 2020, 12:01pm UTC](https://discuss.elastic.co/t/multi-line-logs-javastack-trace-not-showing-up-correctly/242903/10 "2020-07-29T12:01:59Z")
I have not tried to create one on my own . I have been trying to use the ones from the Elasticsearch documentation
---
### Author:  [@Archie\_Crawford](https://discuss.elastic.co/u/Archie_Crawford)
#### Post date: [July 29, 2020, 12:03pm UTC](https://discuss.elastic.co/t/multi-line-logs-javastack-trace-not-showing-up-correctly/242903/11 "2020-07-29T12:03:02Z")
This is the last one I have just tried but I have tried all of the ones on the Elasticsearch multiline page
---
### Author:  [@mtojek](https://discuss.elastic.co/u/mtojek)
#### Post date: [July 29, 2020, 1:51pm UTC](https://discuss.elastic.co/t/multi-line-logs-javastack-trace-not-showing-up-correctly/242903/12 "2020-07-29T13:51:16Z")
Here is relevant documentation: [https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html](https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html)
Your regex need to match to the beginning of the first line of every multiline log record, e.g. (`^date_in_right_format`).
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 26, 2020, 3:51pm UTC](https://discuss.elastic.co/t/multi-line-logs-javastack-trace-not-showing-up-correctly/242903/13 "2020-08-26T15:51:18Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.