# Multiline codec in if else condition in beat input of logstash

**URL:** <https://discuss.elastic.co/t/multiline-codec-in-if-else-condition-in-beat-input-of-logstash/110323>\
**Category:** Logstash\
**Created:** [December 5, 2017, 11:01am UTC](https://discuss.elastic.co/t/multiline-codec-in-if-else-condition-in-beat-input-of-logstash/110323 "2017-12-05T11:01:36Z")\
**Posts on this page:** 1\
**Showing post:** 5

<div class="post-metadata">

**Author:** ![Shubhank\_Gupta](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shubhank_gupta/32/25038_2.png) [@Shubhank\_Gupta](https://discuss.elastic.co/u/Shubhank_Gupta)\
**Post date:** [December 6, 2017, 9:35am UTC](https://discuss.elastic.co/t/multiline-codec-in-if-else-condition-in-beat-input-of-logstash/110323/5 "2017-12-06T09:35:41Z")

</div>

After your guidance,

I did this in filebeat.yml file and changed the filebeat.prospectors

multiline:  
pattern: '^%{WORD:}(%{NONNEGINT:}) captured on %{GREEDYDATA:}'  
negate: true  
match: after

but i don't know how to make same pattern in filebeat as i read here : [Filebeat multiline codec not working in my case](https://discuss.elastic.co/t/filebeat-multiline-codec-not-working-in-my-case/85040)

"filebeat multiline pattern is not grok pattern as in logstash, but pure regular expressions."

Can you help me to convert this logstash pattern in filebeat pattern or regex format ?

Thanks

---

_[View the full topic](https://discuss.elastic.co/t/multiline-codec-in-if-else-condition-in-beat-input-of-logstash/110323)._