# Multiline and blank lines

**URL:** <https://discuss.elastic.co/t/multiline-and-blank-lines/140060>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [July 15, 2018, 1:42pm UTC](https://discuss.elastic.co/t/multiline-and-blank-lines/140060 "2018-07-15T13:42:53Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mv\_unige](https://avatars.discourse-cdn.com/v4/letter/m/cab0a1/32.png) [@mv\_unige](https://discuss.elastic.co/u/mv_unige)\
**Post date:** [July 15, 2018, 1:42pm UTC](https://discuss.elastic.co/t/multiline-and-blank-lines/140060/1 "2018-07-15T13:42:53Z")

</div>

I've the following multiline pattern

```
multiline.pattern: '^\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}.\d{3}'
multiline.negate: true
multiline.match: before

```

Using the Go playground [https://play.golang.org/p/uAd5XHxscu](https://play.golang.org/p/uAd5XHxscu), I can see that lines are correctly matched.

The problem is that there is an empty line in the logs between the error message and the begin of the stack trace. When I send the output of Filebeat to stdout, I observe two events, one for the error message and one for the whole stack trace.

My hypothesis, is that as empty lines are dropped by Filebeat, it makes it impossible to connect the stack trace to the error message.

Are you aware of this problem, is there some workaround?

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [July 16, 2018, 7:57pm UTC](https://discuss.elastic.co/t/multiline-and-blank-lines/140060/2 "2018-07-16T19:57:03Z")

</div>

Could you share some example logs?

---

<div class="post-metadata">

**Author:** ![mv\_unige](https://avatars.discourse-cdn.com/v4/letter/m/cab0a1/32.png) [@mv\_unige](https://discuss.elastic.co/u/mv_unige)\
**Post date:** [July 17, 2018, 7:31am UTC](https://discuss.elastic.co/t/multiline-and-blank-lines/140060/3 "2018-07-17T07:31:57Z")

</div>

I've built a crafted test log file and discovered that it's not a problem of Filebeat.  
You can delete this topic.  
Thank you for your support.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 14, 2018, 7:31am UTC](https://discuss.elastic.co/t/multiline-and-blank-lines/140060/4 "2018-08-14T07:31:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.