# Multiline events not parsed correctly

**URL:** <https://discuss.elastic.co/t/multiline-events-not-parsed-correctly/309123>\
**Category:** Beats\
**Tags:** fleet, elastic-agent\
**Created:** [July 7, 2022, 1:57pm UTC](https://discuss.elastic.co/t/multiline-events-not-parsed-correctly/309123 "2022-07-07T13:57:36Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![DLP\_Admin](https://avatars.discourse-cdn.com/v4/letter/d/9d8465/32.png) [@DLP\_Admin](https://discuss.elastic.co/u/DLP_Admin)\
**Post date:** [July 7, 2022, 1:57pm UTC](https://discuss.elastic.co/t/multiline-events-not-parsed-correctly/309123/1 "2022-07-07T13:57:36Z")

</div>

We are trying to replace custom log parsing performed via Filebeat + Logstash by using the Elastic Agent + Fleet. We built and tested the Ingest Pipeline successfully, and set up the Fleet infrastructure. Reading the log file works okay, but the problem is that log entries are multiline:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/8/18da6313b0d0a16db34c1df21f7aca595b1a3bf1.png)

The grok pattern in our Pipeline acknowledges that, but the Custom Logs integration doesn't seem to like it. We followed all steps from the support article ([Ingest pipelines | Elasticsearch Guide [8.3] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html)), but when we add any entries to the Custom configurations section of the integration policy, the agent stops parsing logs:

![image](https://us1.discourse-cdn.com/elastic/original/3X/0/3/037b6b819cf6dcdfc23698cc084572028d37c40f.png)

Here are the errors from the agent logs:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/e/0ef3c2938494eba67b3829df6e19ec8980f7d333.png)

Can someone please help me understand how multiline logs can be ingested via Elastic Agent?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 4, 2022, 3:57pm UTC](https://discuss.elastic.co/t/multiline-events-not-parsed-correctly/309123/2 "2022-08-04T15:57:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.