# Multiline in TCP input

**URL:** <https://discuss.elastic.co/t/multiline-in-tcp-input/161279>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [December 18, 2018, 8:16am UTC](https://discuss.elastic.co/t/multiline-in-tcp-input/161279 "2018-12-18T08:16:18Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![elmar.vonlanthen](https://avatars.discourse-cdn.com/v4/letter/e/b782af/32.png) [@elmar.vonlanthen](https://discuss.elastic.co/u/elmar.vonlanthen)\
**Post date:** [December 18, 2018, 8:16am UTC](https://discuss.elastic.co/t/multiline-in-tcp-input/161279/1 "2018-12-18T08:16:18Z")

</div>

Hello

I am wondering, if it is possible to use multiline parsing in TCP input. In my tests it is not working. But in UDP input, multiline parsing is working (but not recommended).

Filebeat version: 6.5.3  
OS: CentOS 7.6

Configuration file filebeat.yml:

```
filebeat.inputs:
  - type: tcp
    host: "localhost:9003"
    multiline:
      pattern: '^\s+'
      negate: false
      match: after
  - type: udp
    host: "localhost:9003"
    multiline:
      pattern: '^\s+'
      negate: false
      match: after

output.console:
  pretty: true

```

Test commands:

TCP:

```
$ echo -e "hello\n world" | nc 127.0.0.1 9003

```

UDP:

```
$ echo -e "hello\n world" | nc -u 127.0.0.1 9003

```

Filebeat console output:

```
{
  "@timestamp": "2018-12-18T08:07:40.763Z",
  "@metadata": {
    "beat": "filebeat",
    "type": "doc",
    "version": "6.5.3"
  },
  "message": "hello",
  "source": "127.0.0.1:54206",
  "input": {
    "type": "tcp"
  },
  "prospector": {
    "type": "tcp"
  },
  "beat": {
    "name": "atlantis.vagrant.local",
    "hostname": "atlantis.vagrant.local",
    "version": "6.5.3"
  },
  "host": {
    "name": "atlantis.vagrant.local"
  }
}
{
  "@timestamp": "2018-12-18T08:07:40.764Z",
  "@metadata": {
    "beat": "filebeat",
    "type": "doc",
    "version": "6.5.3"
  },
  "message": " world",
  "source": "127.0.0.1:54206",
  "input": {
    "type": "tcp"
  },
  "prospector": {
    "type": "tcp"
  },
  "beat": {
    "name": "atlantis.vagrant.local",
    "hostname": "atlantis.vagrant.local",
    "version": "6.5.3"
  },
  "host": {
    "name": "atlantis.vagrant.local"
  }
}
{
  "@timestamp": "2018-12-18T08:07:45.824Z",
  "@metadata": {
    "beat": "filebeat",
    "type": "doc",
    "version": "6.5.3",
    "truncated": false
  },
  "beat": {
    "name": "atlantis.vagrant.local",
    "hostname": "atlantis.vagrant.local",
    "version": "6.5.3"
  },
  "host": {
    "name": "atlantis.vagrant.local"
  },
  "message": "hello\n world\n",
  "source": "127.0.0.1:41991",
  "prospector": {
    "type": "udp"
  },
  "input": {
    "type": "udp"
  }
}

```

Thanks for clarification.

Kind regards  
Elmar

---

<div class="post-metadata">

**Author:** ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)\
**Post date:** [December 27, 2018, 2:08pm UTC](https://discuss.elastic.co/t/multiline-in-tcp-input/161279/2 "2018-12-27T14:08:01Z")

</div>

Hello @elmar.vonlanthen

Both the UDP and the TCP are not supporting the _multiline_ option that you are defining. The option is just simply ignored. Beats don't throw errors when it doesn't know the options.

From your example, it appears that the UDP support multiline but the behavior is actually that the input is reading the full datagram it received. It's because in the UDP input we do not track any clients we just act on the received datagram, to have multiline working we would need to keep track of where the events are coming from.

In the case of TCP, I see the need to support multiline and the state could be keep at the connected client level.

---

<div class="post-metadata">

**Author:** ![elmar.vonlanthen](https://avatars.discourse-cdn.com/v4/letter/e/b782af/32.png) [@elmar.vonlanthen](https://discuss.elastic.co/u/elmar.vonlanthen)\
**Post date:** [January 8, 2019, 7:12am UTC](https://discuss.elastic.co/t/multiline-in-tcp-input/161279/3 "2019-01-08T07:12:17Z")

</div>

Hello @pierhugues

Thanks for the explanations. Is there a chance, that multiline support for TCP will be implemented soon?

Kind regards  
Elmar

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 5, 2019, 7:12am UTC](https://discuss.elastic.co/t/multiline-in-tcp-input/161279/4 "2019-02-05T07:12:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.