# Multiline codec in if else condition in beat input of logstash
**URL:** https://discuss.elastic.co/t/multiline-codec-in-if-else-condition-in-beat-input-of-logstash/110323
**Category:** Logstash
**Created:** [December 5, 2017, 11:01am UTC](https://discuss.elastic.co/t/multiline-codec-in-if-else-condition-in-beat-input-of-logstash/110323 "2017-12-05T11:01:36Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@Shubhank\_Gupta](https://discuss.elastic.co/u/Shubhank_Gupta)
#### Post date: [December 5, 2017, 11:01am UTC](https://discuss.elastic.co/t/multiline-codec-in-if-else-condition-in-beat-input-of-logstash/110323/1 "2017-12-05T11:01:36Z")
I want to put condition on input logs through filebeat using type of log but in input section we can't put if else condition if i am right ?
Suggest a method to apply multiline codec on a particular type of log only.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [December 5, 2017, 11:20am UTC](https://discuss.elastic.co/t/multiline-codec-in-if-else-condition-in-beat-input-of-logstash/110323/2 "2017-12-05T11:20:23Z")
Do the multiline processing in Filebeat instead.
---
### Author:  [@Shubhank\_Gupta](https://discuss.elastic.co/u/Shubhank_Gupta)
#### Post date: [December 5, 2017, 1:40pm UTC](https://discuss.elastic.co/t/multiline-codec-in-if-else-condition-in-beat-input-of-logstash/110323/3 "2017-12-05T13:40:27Z")
As i am new to this ELK stack. Suggest me something what to do ? Like changing propectors in filebeat ?
or if possible provide a good example or link of it with method related to this issue.
Thanks
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [December 5, 2017, 2:27pm UTC](https://discuss.elastic.co/t/multiline-codec-in-if-else-condition-in-beat-input-of-logstash/110323/4 "2017-12-05T14:27:59Z")
[https://www.elastic.co/guide/en/beats/filebeat/6.0/multiline-examples.html](https://www.elastic.co/guide/en/beats/filebeat/6.0/multiline-examples.html)
---
### Author:  [@Shubhank\_Gupta](https://discuss.elastic.co/u/Shubhank_Gupta)
#### Post date: [December 6, 2017, 9:35am UTC](https://discuss.elastic.co/t/multiline-codec-in-if-else-condition-in-beat-input-of-logstash/110323/5 "2017-12-06T09:35:41Z")
After your guidance,
I did this in filebeat.yml file and changed the filebeat.prospectors
multiline:
pattern: '^%{WORD:}(%{NONNEGINT:}) captured on %{GREEDYDATA:}'
negate: true
match: after
but i don't know how to make same pattern in filebeat as i read here : [Filebeat multiline codec not working in my case](https://discuss.elastic.co/t/filebeat-multiline-codec-not-working-in-my-case/85040)
"filebeat multiline pattern is not grok pattern as in logstash, but pure regular expressions."
Can you help me to convert this logstash pattern in filebeat pattern or regex format ?
Thanks
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [December 7, 2017, 7:11am UTC](https://discuss.elastic.co/t/multiline-codec-in-if-else-condition-in-beat-input-of-logstash/110323/6 "2017-12-07T07:11:42Z")
I suggest you ask Filebeat questions in the Filebeat category.
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [December 7, 2017, 7:47am UTC](https://discuss.elastic.co/t/multiline-codec-in-if-else-condition-in-beat-input-of-logstash/110323/7 "2017-12-07T07:47:59Z")
You are using grok expressions, which will not work in Filebeat. If you want help with multi-line configuration, I would also recommend including a log sample that shows a full multi-line event as well as a few events that comes after.
---
### Author:  [@Shubhank\_Gupta](https://discuss.elastic.co/u/Shubhank_Gupta)
#### Post date: [December 18, 2017, 11:00am UTC](https://discuss.elastic.co/t/multiline-codec-in-if-else-condition-in-beat-input-of-logstash/110323/8 "2017-12-18T11:00:09Z")
Issue is solved now ...... Thanks all for help.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 15, 2018, 11:00am UTC](https://discuss.elastic.co/t/multiline-codec-in-if-else-condition-in-beat-input-of-logstash/110323/9 "2018-01-15T11:00:31Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.