# Multi-line pattern matching help

**URL:** <https://discuss.elastic.co/t/multi-line-pattern-matching-help/89993>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [June 19, 2017, 9:00pm UTC](https://discuss.elastic.co/t/multi-line-pattern-matching-help/89993 "2017-06-19T21:00:07Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![amarc](https://avatars.discourse-cdn.com/v4/letter/a/ecd19e/32.png) [@amarc](https://discuss.elastic.co/u/amarc)\
**Post date:** [June 19, 2017, 9:00pm UTC](https://discuss.elastic.co/t/multi-line-pattern-matching-help/89993/1 "2017-06-19T21:00:07Z")

</div>

I am trying to capture the following log using multiline pattern.  
If I try to capture it with date `'^\d{4}-\d{2}-\d{2}'` then all the logs (not multine) also get concatenated.  
If I try to capture with `'^[[:space:]]+|^at'` then I miss the previous line which has the date and log level.

```auto
2017-06-07 00:01:22,597 ERROR org.apache.hadoop.hdfs.server.datanode.DataNode: xxx-xxxx.xxx.xxxx.com:71:DataXceiver error processing READ_BLOCK operation src: /10.150.22.231:5921 dst: /10.150.26.22:71
java.net.SocketTimeoutException: 240000 millis timeout while waiting for channel to be ready for write. ch : java.nio.channels.SocketChannel[connected local=/10.150.26.22:71 remote=/10.150.22.231:5921]
	at org.apache.hadoop.net.SocketIOWithTimeout.waitForIO(SocketIOWithTimeout.java:246)
	at org.apache.hadoop.net.SocketOutputStream.waitForWritable(SocketOutputStream.java:172)
	at org.apache.hadoop.net.SocketOutputStream.transferToFully(SocketOutputStream.java:220)
	at org.apache.hadoop.hdfs.server.datanode.BlockSender.sendPacket(BlockSender.java:566)
	at org.apache.hadoop.hdfs.server.datanode.BlockSender.sendBlock(BlockSender.java:735)
	at org.apache.hadoop.hdfs.server.datanode.DataXceiver.readBlock(DataXceiver.java:527)
	at org.apache.hadoop.hdfs.protocol.datatransfer.Receiver.opReadBlock(Receiver.java:116)
	at org.apache.hadoop.hdfs.protocol.datatransfer.Receiver.processOp(Receiver.java:71)
	at org.apache.hadoop.hdfs.server.datanode.DataXceiver.run(DataXceiver.java:239)
	at java.lang.Thread.run(Thread.java:745)

```

---

<div class="post-metadata">

**Author:** ![amarc](https://avatars.discourse-cdn.com/v4/letter/a/ecd19e/32.png) [@amarc](https://discuss.elastic.co/u/amarc)\
**Post date:** [June 19, 2017, 9:36pm UTC](https://discuss.elastic.co/t/multi-line-pattern-matching-help/89993/2 "2017-06-19T21:36:14Z")

</div>

Solved it using:

```auto
  multiline.pattern: '^\d{4}-\d{2}-\d{2}'
  multiline.negate: True
  multiline.match: after

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 17, 2017, 9:36pm UTC](https://discuss.elastic.co/t/multi-line-pattern-matching-help/89993/3 "2017-07-17T21:36:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.