# Multiline is not fetching desired result from filebeat to ES

**URL:** <https://discuss.elastic.co/t/multiline-is-not-fetching-desired-result-from-filebeat-to-es/218772>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [February 11, 2020, 12:52pm UTC](https://discuss.elastic.co/t/multiline-is-not-fetching-desired-result-from-filebeat-to-es/218772 "2020-02-11T12:52:16Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Darshan\_Kamat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/darshan_kamat/32/44993_2.png) [@Darshan\_Kamat](https://discuss.elastic.co/u/Darshan_Kamat)\
**Post date:** [February 11, 2020, 12:52pm UTC](https://discuss.elastic.co/t/multiline-is-not-fetching-desired-result-from-filebeat-to-es/218772/1 "2020-02-11T12:52:16Z")

</div>

I am not getting desired result .I have sample logs like below .I have multiline setting

multiline.pattern: '^[0-9]{4}'  
multiline.negate: true  
multiline.match: after

1.when i search for "2003787391047586" i want entire xml in output as 1 event  
2.How to specify multiline pattern for date that has format "2020 Feb 11 06:56:30:554"

2020 Feb 11 06:56:30:554 GMT -0500 DEBUG [LogPool$0] com.ZU.digital.utilityservices.logging.Logging - EAI-DEBUG | ProcessOrderStatus.rule: Id - : OrderStatusNotification Payload : \<?xml version="1.0" encoding="UTF-8"?\>  
\<ns0:OSN \>  
ns0:merchantID200142\</ns0:merchantID\>  
ns0:orderCode2003787391047586\</ns0:orderCode\>  
ns0:lastEventCAPTURED\</ns0:lastEvent\>  
ns0:paymentAmount12.90\</ns0:paymentAmount\>  
ns0:paymentCurrencyEUR\</ns0:paymentCurrency\>  
ns0:paymentCreditDebitINDC\</ns0:paymentCreditDebitIND\>  
ns0:additionalData  
ns0:data  
ns0:name/  
ns0:value/  
\</ns0:data\>  
\</ns0:additionalData\>  
\</ns0:OSN\>  
2020 Feb 11 06:56:30:554 GMT -0500 DEBUG [LogPool$0] com.ZU.digital.utilityservices.logging.Logging - Masking input XML in maskEntireXml

---

<div class="post-metadata">

**Author:** ![Darshan\_Kamat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/darshan_kamat/32/44993_2.png) [@Darshan\_Kamat](https://discuss.elastic.co/u/Darshan_Kamat)\
**Post date:** [February 13, 2020, 6:12am UTC](https://discuss.elastic.co/t/multiline-is-not-fetching-desired-result-from-filebeat-to-es/218772/2 "2020-02-13T06:12:16Z")

</div>

Can anyone please help here.

---

<div class="post-metadata">

**Author:** ![Darshan\_Kamat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/darshan_kamat/32/44993_2.png) [@Darshan\_Kamat](https://discuss.elastic.co/u/Darshan_Kamat)\
**Post date:** [February 14, 2020, 6:14am UTC](https://discuss.elastic.co/t/multiline-is-not-fetching-desired-result-from-filebeat-to-es/218772/3 "2020-02-14T06:14:52Z")

</div>

I tried with this expression  
'^[0-9]{4}[[:space:]]'

it is giving desired result in go playground but not working in actual filebeat

---

<div class="post-metadata">

**Author:** ![Darshan\_Kamat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/darshan_kamat/32/44993_2.png) [@Darshan\_Kamat](https://discuss.elastic.co/u/Darshan_Kamat)\
**Post date:** [February 18, 2020, 10:37am UTC](https://discuss.elastic.co/t/multiline-is-not-fetching-desired-result-from-filebeat-to-es/218772/4 "2020-02-18T10:37:26Z")

</div>

Got resolved after making  
negate to true

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 17, 2020, 10:37am UTC](https://discuss.elastic.co/t/multiline-is-not-fetching-desired-result-from-filebeat-to-es/218772/5 "2020-03-17T10:37:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.