# Multiline breaking in blank line

**URL:** <https://discuss.elastic.co/t/multiline-breaking-in-blank-line/258359>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [December 11, 2020, 3:32am UTC](https://discuss.elastic.co/t/multiline-breaking-in-blank-line/258359 "2020-12-11T03:32:04Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![newmember](https://avatars.discourse-cdn.com/v4/letter/n/ce7236/32.png) [@newmember](https://discuss.elastic.co/u/newmember)\
**Post date:** [December 11, 2020, 3:32am UTC](https://discuss.elastic.co/t/multiline-breaking-in-blank-line/258359/1 "2020-12-11T03:32:05Z")

</div>

This has been reports a few times but I can not put the answer together.  
I would like these lines to arrive as one multiline. But they arrive as 5 lines. Which is odd because the pattern clearly only matches the first line.

Ref:  
[Filebeat 1.1.1: empty line is always treated as multiline events separator · Issue #1040 · elastic/beats · GitHub](https://github.com/elastic/beats/issues/1040)  
[Filebeat not sending empty lines - Elastic Stack / Beats - Discuss the Elastic Stack](https://discuss.elastic.co/t/filebeat-not-sending-empty-lines/118060)  
[Multiline and blank lines - Elastic Stack / Beats - Discuss the Elastic Stack](https://discuss.elastic.co/t/multiline-and-blank-lines/140060)

```auto
  multiline.type: pattern
  multiline.pattern: '^\d{2}:\d{2}:\d{2}.\d{3}'
  multiline.negate: true
  multiline.match: after

```

```auto
19:00:22.167 Trc 04541 Message 

  MSGCFG
  attr:   
  attr:
  attr: 

```

---

<div class="post-metadata">

**Author:** ![newmember](https://avatars.discourse-cdn.com/v4/letter/n/ce7236/32.png) [@newmember](https://discuss.elastic.co/u/newmember)\
**Post date:** [December 11, 2020, 3:42am UTC](https://discuss.elastic.co/t/multiline-breaking-in-blank-line/258359/2 "2020-12-11T03:42:04Z")

</div>

Odd;

As soon as I did this post it works.

I tested this pattern:

```auto
multiline.pattern: '^\d{2}:\d{2}:\d{2}.\d{3}|$'

```

no good

Switched it back to

```auto
 multiline.pattern: '^\d{2}:\d{2}:\d{2}.\d{3}'

```

add it worked.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 8, 2021, 5:42am UTC](https://discuss.elastic.co/t/multiline-breaking-in-blank-line/258359/3 "2021-01-08T05:42:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.