# Multiline config for continuation with empty lines interspersed

**URL:** <https://discuss.elastic.co/t/multiline-config-for-continuation-with-empty-lines-interspersed/249365>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [September 21, 2020, 1:13pm UTC](https://discuss.elastic.co/t/multiline-config-for-continuation-with-empty-lines-interspersed/249365 "2020-09-21T13:13:08Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![kornexl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kornexl/32/75935_2.png) [@kornexl](https://discuss.elastic.co/u/kornexl)\
**Post date:** [September 21, 2020, 1:13pm UTC](https://discuss.elastic.co/t/multiline-config-for-continuation-with-empty-lines-interspersed/249365/1 "2020-09-21T13:13:08Z")

</div>

I want to use multiline feature for messages in error.log.  
The error lines to match are mixed with empty lines  
Error cccccc

continuation error line

The default multiline pattern ( ^[[:space:]] ) for this type of continuation does not work for these empty lines (not even a white space in this line).  
The concatenation stops with the empty line.

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [September 21, 2020, 1:33pm UTC](https://discuss.elastic.co/t/multiline-config-for-continuation-with-empty-lines-interspersed/249365/2 "2020-09-21T13:33:12Z")

</div>

Could you please share your Filebeat configuration formatted using `</>`? Also, please share example input logs and the desired output.

---

<div class="post-metadata">

**Author:** ![kornexl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kornexl/32/75935_2.png) [@kornexl](https://discuss.elastic.co/u/kornexl)\
**Post date:** [September 21, 2020, 2:03pm UTC](https://discuss.elastic.co/t/multiline-config-for-continuation-with-empty-lines-interspersed/249365/3 "2020-09-21T14:03:21Z")

</div>

multiline def in filebeat/modules.d/apache.yml

```auto
multiline.type: pattern
multiline.pattern: '^[[:space:]]'
multiline.negate: false
multiline.match: after

```

example log:

```auto
    ERROR: KIX-CGI-10 Perl: 5.22.1 OS: linux Time: Mon Sep 21 11:15:06 2020

     Message: Got no SessionID!!

     RemoteAddress: 1.2.3.4
     RequestURI: /kix/index.pl?Action=Logout;ChallengeToken=4OLqfsBqx31B6UEnPpHPkdOq2eFgsNVT;

     Traceback (2182):
       Module: Kernel::System::AuthSession::DB::CheckSessionID Line: 59
       Module: Kernel::System::AuthSession::CheckSessionID Line: 89
       Module: Kernel::System::Web::InterfaceAgent::Run Line: 482
       Module: ModPerl::ROOT::ModPerl::Registry::opt_kix_bin_cgi_2dbin_index_2epl::handler Line: 39
       Module: (eval) (v1.99) Line: 207
       Module: ModPerl::RegistryCooker::run (v1.99) Line: 207
       Module: ModPerl::RegistryCooker::default_handler (v1.99) Line: 173
       Module: ModPerl::Registry::handler (v1.99) Line: 32

    [Mon Sep 21 11:28:30 2020] -e: Use of uninitialized value $CallingAction in concatenation (.) or string at /opt/kix//Kernel/Modules/SaveAsDraftAJAXHandler.pm line 51.

```

expected result: (multiple lines in one message)

```auto
`ERROR: KIX-CGI-10 Perl: 5.22.1 OS: linux Time: Mon Sep 21 11:15:06 2020 Message: Got no SessionID!! RemoteAddress: 1.2.3.4 RequestURI: /kix/index.pl?Action=Logout;ChallengeToken=4OLqfsBqx31B6UEnPpHPkdOq2eFgsNVT;`

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 19, 2020, 4:03pm UTC](https://discuss.elastic.co/t/multiline-config-for-continuation-with-empty-lines-interspersed/249365/4 "2020-10-19T16:03:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.