# Multiline configuration, several prospectors

**URL:** https://discuss.elastic.co/t/multiline-configuration-several-prospectors/85511
**Category:** Beats
**Tags:** filebeat
**Created:** [May 12, 2017, 7:26am UTC](https://discuss.elastic.co/t/multiline-configuration-several-prospectors/85511 "2017-05-12T07:26:20Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Vedran\_Maricevic](https://avatars.discourse-cdn.com/v4/letter/v/57b2e6/32.png) [@Vedran\_Maricevic](https://discuss.elastic.co/u/Vedran_Maricevic)
#### Post date: [May 12, 2017, 7:26am UTC](https://discuss.elastic.co/t/multiline-configuration-several-prospectors/85511/1 "2017-05-12T07:26:20Z")

</div>

I have one filebeat that reads severals different log formats. I have this settings.  
One format that works just fine is a single liner, which is sent to Logstash as a single event.  
Now, I have another format that is a multiliner. I want to read it as a single event and send it to Logstash for parsing.  
This is the log format example, with two events.

```
error: I READ THIS. sent payload: [{"key": "values"}]
custom status response: [{"key1": "values"}]
callback headers: [{"key2": "values"}]
error stack: [ something really bad happened
    at here loremisptul (/xx/xx/x)
    at here loremisptul (/xx/xx/x)
    at here loremisptul (/xx/xx/x)
    at here loremisptul (/xx/xx/x)
    at here loremisptul (/xx/xx/x)
    at here loremisptul (/xx/xx/x)
    at here loremisptul (/xx/xx/x)
    at here loremisptul (/xx/xx/x)]

error: I AM NOT READING THIS. sent payload: [{"key": "values"}]
custom status response: [{"key1": "values"}]
callback headers: [{"key2": "values"}]
error stack: [ something really bad happened
    at here loremisptul (/xx/xx/x)
    at here loremisptul (/xx/xx/x)
    at here loremisptul (/xx/xx/x)
    at here loremisptul (/xx/xx/x)
    at here loremisptul (/xx/xx/x)
    at here loremisptul (/xx/xx/x)
    at here loremisptul (/xx/xx/x)
    at here loremisptul (/xx/xx/x)]

```

And here is the prospector configuration:

```
- input_type: log
  paths: /Users/xxxxx/Downloads/elk/anotherlog/app.stderr.log
  document_type: logsystemtwo
  multiline.pattern: '`^=[A-Z]+|^$`'
  multiline.negate: true
  multiline.match: after
- input_type: log
  paths: /Users/xxxxx/Downloads/elk/mylogs/access.log*
  document_type: logsystemone

```

The issue is with the first multiline. It reads first event (I READ THIS), but ignores rest of it (I AM NOT READING THIS).

I have tried many different [configurations](https://www.elastic.co/guide/en/beats/filebeat/1.2/multiline-examples.html), but I just cant get it to read other events.

---

<div class="post-metadata">

### Author: ![Vedran\_Maricevic](https://avatars.discourse-cdn.com/v4/letter/v/57b2e6/32.png) [@Vedran\_Maricevic](https://discuss.elastic.co/u/Vedran_Maricevic)
#### Post date: [May 12, 2017, 9:52am UTC](https://discuss.elastic.co/t/multiline-configuration-several-prospectors/85511/2 "2017-05-12T09:52:38Z")

</div>

I have found the solution.

```
- input_type: log
  paths: /Users/xxxxx/Downloads/elk/logs/app.stderr.log
  document_type: error
  multiline.pattern: '^error: '
  multiline.negate: true
  multiline.match: after
```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 9, 2017, 10:06am UTC](https://discuss.elastic.co/t/multiline-configuration-several-prospectors/85511/3 "2017-06-09T10:06:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.