# Multiline does not append the lines

**URL:** <https://discuss.elastic.co/t/multiline-does-not-append-the-lines/353625>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [February 19, 2024, 3:49pm UTC](https://discuss.elastic.co/t/multiline-does-not-append-the-lines/353625 "2024-02-19T15:49:50Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Pedro\_Lopez\_Gonzalez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pedro_lopez_gonzalez/32/131886_2.png) [@Pedro\_Lopez\_Gonzalez](https://discuss.elastic.co/u/Pedro_Lopez_Gonzalez)\
**Post date:** [February 19, 2024, 3:49pm UTC](https://discuss.elastic.co/t/multiline-does-not-append-the-lines/353625/1 "2024-02-19T15:49:50Z")

</div>

Hi all,  
I have configured a parser to join the lines into one but it doesn´t work.  
This is the configuration code:

```auto
filebeat.inputs:

# Each - is an input. Most options can be set at the input level, so
# you can use different inputs for various configurations.
# Below are the input specific configurations.

- type: filestream

  # Change to true to enable this input configuration.
  enabled: true

  # Paths that should be crawled and fetched. Glob based paths.
  paths:
    - /root/ELK/input/logs/*.log

parsers:

- multiline:
    type: pattern
    pattern: '^[0-9]{4}'
    negate: true
    match: after

```

The log looks like this:

```auto
2024 Feb 07 14:48:29:905 GMT +0100 BW.Promociones-Process_Archive_AOTLXPRTIB00014 Info [BW-User] - Job-365623 [Procesos_GDP/09020/Operaciones/PC_Peticion_BSCSConsultas_03030.process/Group/Log Peticion a Enviar]: 07/02/2024 14:48:29 - TrackingId: i2Sj2ScfUxD1E-KviG-7fcVkbGI - Se va a publicar a BSCS: <ns0:C __03030__ Peticion xmlns:ns0="http://www.tibco.com/xmlns/ae2xsd/2002/05/ae/AMENA/MOVILES/SERVICIOS/BSCSConsultas/C_03030">
<SourceMsgId>c24ce31c-b3cf-4aa1-9e4d-5187407bdeb0</SourceMsgId>
    <SourceHost>TIBCO11P</SourceHost>
    <Version>BW</Version>
    <AppName>PasarelaBW6.GDP</AppName>
    <Estado>0</Estado>
    <FiltroGDP>09020</FiltroGDP>
    <TimeStamp>2024-02-07T14:48:29.905+01:00</TimeStamp>
    <IdAux>HTTP_IVR-pasarelaBW6</IdAux>
    <TimeOut>0</TimeOut>
    <FiltroRespuesta>09020</FiltroRespuesta>
    <TimeStampOrigen>2024-02-07T14:48:29.887</TimeStampOrigen>
    <MsisdnAmpliado>
        <Msisdn>685236416</Msisdn>
    </MsisdnAmpliado>
    <IntervaloFechas>
        <FechaInicio>20240207</FechaInicio>
        <FechaFin>20240207</FechaFin>
    </IntervaloFechas>
    <Sistema>
        <Sistema>IVR</Sistema>
    </Sistema>
    <Flag>
        <Flag>N</Flag>
    </Flag>
    <Promocion>
        <IdCatalogoCRM>4016</IdCatalogoCRM>
    </Promocion>
</ns0:C __03030__ Peticion>

```

Any ideas?

Regards

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [February 19, 2024, 4:45pm UTC](https://discuss.elastic.co/t/multiline-does-not-append-the-lines/353625/2 "2024-02-19T16:45:16Z")

</div>

Hi @Pedro_Lopez_Gonzalez

What version of Filebeat?

and you have indentations issues in your .yml

```auto
filebeat.inputs:

# Each - is an input. Most options can be set at the input level, so
# you can use different inputs for various configurations.
# Below are the input specific configurations.

- type: filestream

  # Change to true to enable this input configuration.
  enabled: true

  # Paths that should be crawled and fetched. Glob based paths.
  paths:
    - /root/ELK/input/logs/*.log

  parsers: # HERE
  - multiline:
      type: pattern
      pattern: '^[0-9]{4}'
      negate: true
      match: after

```

---

<div class="post-metadata">

**Author:** ![Pedro\_Lopez\_Gonzalez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pedro_lopez_gonzalez/32/131886_2.png) [@Pedro\_Lopez\_Gonzalez](https://discuss.elastic.co/u/Pedro_Lopez_Gonzalez)\
**Post date:** [February 19, 2024, 4:55pm UTC](https://discuss.elastic.co/t/multiline-does-not-append-the-lines/353625/3 "2024-02-19T16:55:33Z")

</div>

Thanks so much Stephen

The problem was the indentation

Regards,

Pedro

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 18, 2024, 6:56pm UTC](https://discuss.elastic.co/t/multiline-does-not-append-the-lines/353625/4 "2024-03-18T18:56:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.