# Multiline breaks on empty line \\n\\n restarts new line

**URL:** <https://discuss.elastic.co/t/multiline-breaks-on-empty-line-n-n-restarts-new-line/59717>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [September 2, 2016, 10:35pm UTC](https://discuss.elastic.co/t/multiline-breaks-on-empty-line-n-n-restarts-new-line/59717 "2016-09-02T22:35:28Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tim\_Burt](https://avatars.discourse-cdn.com/v4/letter/t/e68b1a/32.png) [@Tim\_Burt](https://discuss.elastic.co/u/Tim_Burt)\
**Post date:** [September 2, 2016, 10:35pm UTC](https://discuss.elastic.co/t/multiline-breaks-on-empty-line-n-n-restarts-new-line/59717/1 "2016-09-02T22:35:28Z")

</div>

The multiline filter in filebeats works well with the default config is used:

```
  multiline:
    pattern: ^\[
    negate: true
    match: after

```

And the log lines are consecutive following the pattern.

However, if two consecutive line breaks occur in the lines that follow:

```auto
-------------------------------------
[2016-09-02 19:54:23 +0000] Started 2016-09-02 19:54:23 +0000 "GET" for /gaq?path=%2FCA%2FFallbrook%2F1845-Acacia-Ln&referer=http%3A%2F%2Fwww.xxxxx.com%2FAcacia%2BLn%2BFallbrook%2BCA%2Baddresses&search_bucket=none&page_controller=v9%2Faddresses&page_action=show at 23.235.47.31
X-Forwarded-For:72.197.227.93, 23.235.47.31
Processing by GoogleAnalyticsController#index as JSON

  Parameters: {"path"=>"/CA/Fallbrook/1845-Acacia-Ln", "referer"=>"http://www.xxxx.com/Acacia+Ln+Fallbrook+CA+addresses", "search_bucket"=>"none", "page_controller"=>"v9/addresses", "page_action"=>"show"}
Completed 200 OK in 5ms (Views: 1.9ms)
[2016-09-02 19:54:23 +0000] Started 2016-09-02 19:54:23 +0000 "GET" for /health_check at xxx.xx.44.181
X-Forwarded-For:
SetAdCodeMiddleware.default_ad_code referer
SetAdCodeMiddleware.default_ad_code path /health_check
SetAdCodeMiddleware.default_ad_code route 
----------------------------------

```

The multiline processing stops at the "GoogleAnalytics" line and starts fresh with the "Parameters:" line.

Two consecutive newlines causes the multiline to restart, which does not conform to the config that new records begin with "^[".

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [September 6, 2016, 7:42am UTC](https://discuss.elastic.co/t/multiline-breaks-on-empty-line-n-n-restarts-new-line/59717/2 "2016-09-06T07:42:42Z")

</div>

Which filebeat version are you using?

---

<div class="post-metadata">

**Author:** ![Tim\_Burt](https://avatars.discourse-cdn.com/v4/letter/t/e68b1a/32.png) [@Tim\_Burt](https://discuss.elastic.co/u/Tim_Burt)\
**Post date:** [September 6, 2016, 9:14am UTC](https://discuss.elastic.co/t/multiline-breaks-on-empty-line-n-n-restarts-new-line/59717/3 "2016-09-06T09:14:14Z")

</div>

5.0 alpha, compiled from source about 10 days ago.

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [September 6, 2016, 11:52am UTC](https://discuss.elastic.co/t/multiline-breaks-on-empty-line-n-n-restarts-new-line/59717/4 "2016-09-06T11:52:09Z")

</div>

I tried to reproduce this by adding a system test to filebeat: [https://github.com/elastic/beats/pull/2469](https://github.com/elastic/beats/pull/2469) So far it looks green.

Could you share the log output (best in debug level)?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 23, 2016, 10:35pm UTC](https://discuss.elastic.co/t/multiline-breaks-on-empty-line-n-n-restarts-new-line/59717/5 "2016-09-23T22:35:50Z")

</div>

This topic was automatically closed after 21 days. New replies are no longer allowed.