# Multiline Config Failing
**URL:** https://discuss.elastic.co/t/multiline-config-failing/47078
**Category:** Beats
**Tags:** filebeat
**Created:** [April 12, 2016, 7:40am UTC](https://discuss.elastic.co/t/multiline-config-failing/47078 "2016-04-12T07:40:55Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@dawiro](https://discuss.elastic.co/u/dawiro)
#### Post date: [April 12, 2016, 7:40am UTC](https://discuss.elastic.co/t/multiline-config-failing/47078/1 "2016-04-12T07:40:55Z")
Hi,
My filebeat prospector config looks like this:
```auto
filebeat:
prospectors:
- document_type: cassandra
input_type: log
paths:
- /var/log/cassandra/*.log
- /var/log/cassandra/audit/*.log
scan_frequency: 5s
ignore_older: 168h
multiline:
pattern: "^\s"
match: after
```
However, adding the multiline config causes the prospector file to fail to load. If I remove the multiline element then the config loads fine. What is wrong with this configuration?
Regards,
David
---
### Author:  [@tudor](https://discuss.elastic.co/u/tudor)
#### Post date: [April 12, 2016, 12:25pm UTC](https://discuss.elastic.co/t/multiline-config-failing/47078/2 "2016-04-12T12:25:22Z")
It looks ok to me. What error do you get?
---
### Author:  [@tudor](https://discuss.elastic.co/u/tudor)
#### Post date: [April 12, 2016, 1:52pm UTC](https://discuss.elastic.co/t/multiline-config-failing/47078/3 "2016-04-12T13:52:00Z")
Ah, I think I know what the problem is. If you use double quotes, you need to escape the backslash, `"^\\s"`. In this case, you can also go without quotes, in which case you don't need the double backslash. I recommend passing configs through [http://www.yamllint.com/](http://www.yamllint.com/) when you get weird errors like this.
---
### Author:  [@dawiro](https://discuss.elastic.co/u/dawiro)
#### Post date: [April 12, 2016, 2:16pm UTC](https://discuss.elastic.co/t/multiline-config-failing/47078/4 "2016-04-12T14:16:33Z")
Thanks, I've tried that and get this:
2016-04-12T15:11:54+01:00 INFO Harvester started for file: /var/log/cassandra/system.log
2016-04-12T15:11:54+01:00 ERR Stop Harvesting. Unexpected encoding line reader error: error parsing regexp: invalid escape sequence: `\s`
2016-04-12T15:11:54+01:00 DBG Closing file: /var/log/cassandra/system.log
2016-04-12T15:11:54+01:00 DBG Check file for harvesting: /var/log/cassandra/audit/dropped-events.log
2016-04-12T15:11:54+01:00 DBG Update existing file for harvesting: /var/log/cassandra/audit/dropped-events.log
2016-04-12T15:11:54+01:00 DBG Not harvesting, file didn't change: /var/log/cassandra/audit/dropped-events.log
2016-04-12T15:11:56+01:00 DBG Flushing spooler because of timeout. Events flushed: 0
The config loads ok and now looks like this:
```
multiline:
pattern: "^\\s"
match: after
```
I've tried it without quotes and it still complains...
---
### Author:  [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [April 12, 2016, 4:35pm UTC](https://discuss.elastic.co/t/multiline-config-failing/47078/5 "2016-04-12T16:35:50Z")
have you tried single quotes `'` ?
---
### Author:  [@dawiro](https://discuss.elastic.co/u/dawiro)
#### Post date: [April 13, 2016, 10:14am UTC](https://discuss.elastic.co/t/multiline-config-failing/47078/6 "2016-04-13T10:14:37Z")
Yes I have. Both lead to the same error...
---
### Author:  [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [April 13, 2016, 12:07pm UTC](https://discuss.elastic.co/t/multiline-config-failing/47078/7 "2016-04-13T12:07:30Z")
can you share your full filebeat.yml?
Plus, read the log message again:
```auto
2016-04-12T15:11:54+01:00 ERR Stop Harvesting. Unexpected encoding line reader error: error parsing regexp: invalid escape sequence: \s
```
It says `\s` itself is invalid, it is not saying it can not parse it. Use `[[:space:]]`. Also [check out the docs](https://www.elastic.co/guide/en/beats/filebeat/current/regexp-support.html)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2017, 9:53pm UTC](https://discuss.elastic.co/t/multiline-config-failing/47078/8 "2017-07-05T21:53:21Z")