@pg99bassists Please consider creating a new topic, as this one has been marked as solved already. The regex is applied to every single line in multiline. That is ^ should do the right thing. When doing regexes on already concatenated multiline events it depends on the regex engine how ^ will actually be handled. It's not clear to me what exactly you're doing and where you apply regexes. Please add configs + filebeat/logstash versions you're using.