# Multiline Command not working for Start and End of event

**URL:** <https://discuss.elastic.co/t/multiline-command-not-working-for-start-and-end-of-event/166444>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [January 30, 2019, 11:12pm UTC](https://discuss.elastic.co/t/multiline-command-not-working-for-start-and-end-of-event/166444 "2019-01-30T23:12:49Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![miloni\_134](https://avatars.discourse-cdn.com/v4/letter/m/ecd19e/32.png) [@miloni\_134](https://discuss.elastic.co/u/miloni_134)\
**Post date:** [January 30, 2019, 11:12pm UTC](https://discuss.elastic.co/t/multiline-command-not-working-for-start-and-end-of-event/166444/1 "2019-01-30T23:12:49Z")

</div>

Hello,

I have a log file which looks something like this:

2018-12-13 04:49:35,019 [thread: Start] INFO StateManager [(null)] (StartLogInfo) - StartLog passed info start  
2018-12-13 04:49:35,020 [thread: Start] INFO StateManager [(null)] (StartLog) - abc= 20  
2018-12-13 04:49:35,020 [thread: Start] INFO StateManager [(null)] (StartLog) - xyz = dg  
2018-12-13 04:49:35,020 [thread: Start] INFO StateManager [(null)] (StartLog) - pqr = sdfsdfds  
2018-12-13 04:49:35,020 [thread: Start] INFO StateManager [(null)] (StartLog) - lmn = A  
2018-12-13 04:49:35,020 [thread: Start] INFO StateManager [(null)] (StartLog) - zczczxc = U  
2018-12-13 04:49:35,021 [thread: Start] INFO StateManager [(null)] (StartLog) - dvdfd = cdc  
2018-12-13 04:49:35,028 [thread: Start] INFO StateManager [(null)] (StartLog) - StartLog passed info end

It has got a start : 2018-12-13 04:49:35,019 [thread: Start] INFO StateManager [(null)] (StartLogInfo) - StartLog passed info start  
and end : 2018-12-13 04:49:35,028 [thread: Start] INFO StateManager [(null)] (StartLog) - StartLog passed info end  
markers.

I want to Combine all the events which are in between start and end to get it as a single message in order to get fields like abc, xyz, etc.

I tried using the multiline command in filebeat:

multiline.pattern: '._StartLog passed info startt._'  
multiline.negate: false  
multiline.match: before  
multiline.flush\_pattern: '._StartLog passed info end._'

I want to merge all the intermediate events and send it to Kafka, but its not working!

Can someone point out the mistake or give any solution to it?  
It will be a great help!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 27, 2019, 11:12pm UTC](https://discuss.elastic.co/t/multiline-command-not-working-for-start-and-end-of-event/166444/2 "2019-02-27T23:12:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.