# Multiline example simulation issue

**URL:** https://discuss.elastic.co/t/multiline-example-simulation-issue/97453
**Category:** Beats
**Tags:** filebeat
**Created:** [August 17, 2017, 3:45pm UTC](https://discuss.elastic.co/t/multiline-example-simulation-issue/97453 "2017-08-17T15:45:32Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Vivek\_Sharma](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vivek_sharma/32/46948_2.png) [@Vivek\_Sharma](https://discuss.elastic.co/u/Vivek_Sharma)
#### Post date: [August 17, 2017, 3:45pm UTC](https://discuss.elastic.co/t/multiline-example-simulation-issue/97453/1 "2017-08-17T15:45:32Z")

</div>

Hi

I tried simulating the multiline example given at link:

> **[Manage multiline messages | Filebeat Reference \[8.11\] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html)**

Below are my filebeat.yml details.

> ```
> filebeat.prospectors:
> 
> # Each - is a prospector. Most options can be set at the prospector level, so
> # you can use different prospectors for various configurations.
> # Below are the prospector specific configurations.
> 
> #- input_type: log
> 
> - input_type: log 
> paths:
> - C:\ELK\*.log
>   
>   
>   
> 
> multiline.pattern: '^[[:space:]]'
> multiline.negate: false
> multiline.match: after
> 
> ```

But when I run and view the logs, the logs are coming in separate lines instead of single line. Can anyone please help. Below is the log that we are using:

> Exception in thread "main" java.lang.NullPointerException  
> at com.example.myproject.Book.getTitle(Book.java:16)  
> at com.example.myproject.Author.getBookTitles(Author.java:25)  
> at com.example.myproject.Bootstrap.main(Bootstrap.java:14)

Can anyone please help.

Thanks

---

<div class="post-metadata">

### Author: ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [August 17, 2017, 10:03pm UTC](https://discuss.elastic.co/t/multiline-example-simulation-issue/97453/2 "2017-08-17T22:03:23Z")

</div>

The multline configuration options need to be part of the prospector configuration (since these are not global options). So they should be indented at the same level as `input_type` and `paths`. For example:

```auto
--- 
filebeat.prospectors: 
  - 
    input_type: log
    multiline.match: after
    multiline.negate: false
    multiline.pattern: "^[[:space:]]"
    paths: 
      - "C:\\ELK\\*.log"

```

---

<div class="post-metadata">

### Author: ![Vivek\_Sharma](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vivek_sharma/32/46948_2.png) [@Vivek\_Sharma](https://discuss.elastic.co/u/Vivek_Sharma)
#### Post date: [August 18, 2017, 10:28am UTC](https://discuss.elastic.co/t/multiline-example-simulation-issue/97453/3 "2017-08-18T10:28:52Z")

</div>

Thanks Andrew for your help.

My problem is not 100% resolved as the logs with multiline are now captured with enter key.

I am not sure how can I read enter key line break in logstash.

Can you please provide some inputs on this issue as well.

Thanks

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 15, 2017, 10:37am UTC](https://discuss.elastic.co/t/multiline-example-simulation-issue/97453/4 "2017-09-15T10:37:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.