# Multiline is not working when i am sending logs to logstash through filebeat?
**URL:** https://discuss.elastic.co/t/multiline-is-not-working-when-i-am-sending-logs-to-logstash-through-filebeat/88170
**Category:** Beats
**Tags:** filebeat
**Created:** [June 4, 2017, 6:12am UTC](https://discuss.elastic.co/t/multiline-is-not-working-when-i-am-sending-logs-to-logstash-through-filebeat/88170 "2017-06-04T06:12:39Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@Yaswanth](https://discuss.elastic.co/u/Yaswanth)
#### Post date: [June 4, 2017, 6:12am UTC](https://discuss.elastic.co/t/multiline-is-not-working-when-i-am-sending-logs-to-logstash-through-filebeat/88170/1 "2017-06-04T06:12:39Z")
Hi,
Logs:
```
[2017-05-25 01:00:00,647][ERROR][marvel.agent.exporter.local] local exporter [default_local] - ...
[2017-05-18 00:00:06,339][DEBUG][action.admin.indices.create] [data-2] [data-may-2017,data-apr-..
```
When i am sending logs from filebeat to logstash through multiline codec in the filebeat configuration it is not working .
My filebeat config:
```
- input_type: log
# Paths that should be crawled and fetched. Glob based paths.
paths:
- F:\elasticsearch-2.4.0\elasticsearch-2.4.0\logs\elasticsearch_index_search_slowlog.log
#- c:\programdata\elasticsearch\logs\*
multiline.pattern: ^\[%{TIMESTAMP_ISO8601:TIMESTAMP}\]
multiline.negate: true
multiline.match: "after"
output.logstash:
# The Logstash hosts
hosts: ["localhost:5044"]
logging:
to_files: true
files:
path: C:\Program Files\filebeat\logs
level: debug
selectors: ["*"]
```
Output: My both logs are merged together and coming
Logstash: When i used the same multiline in logstash it is working fine . I can see my logs are separated.
Whether the problem is in my filebeat configuration?
Thanks
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [June 4, 2017, 8:43am UTC](https://discuss.elastic.co/t/multiline-is-not-working-when-i-am-sending-logs-to-logstash-through-filebeat/88170/2 "2017-06-04T08:43:16Z")
You seem to be using grok syntax in the Filebeat config, which I suspect is why it is not working. Have a look at [the example in the documentation](https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html#_timestamps) to see what it should look like. Change this and remove the multiline codec from the beats input and see if that helps.
---
### Author:  [@Yaswanth](https://discuss.elastic.co/u/Yaswanth)
#### Post date: [June 4, 2017, 8:50am UTC](https://discuss.elastic.co/t/multiline-is-not-working-when-i-am-sending-logs-to-logstash-through-filebeat/88170/3 "2017-06-04T08:50:59Z")
Thanks..
But when i used below pattern it is working fine in logstash.[quote="Yaswanth, post:1, topic:88170"]
^[%{TIMESTAMP\_ISO8601:TIMESTAMP}]
[/quote]
Did it differ that much in Filebeat?
Thanks
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [June 4, 2017, 9:07am UTC](https://discuss.elastic.co/t/multiline-is-not-working-when-i-am-sending-logs-to-logstash-through-filebeat/88170/4 "2017-06-04T09:07:12Z")
As far as I know Filebeat does not support grok syntax, so patterns will need to be different as outlined in the documentation.
---
### Author:  [@Yaswanth](https://discuss.elastic.co/u/Yaswanth)
#### Post date: [June 4, 2017, 9:09am UTC](https://discuss.elastic.co/t/multiline-is-not-working-when-i-am-sending-logs-to-logstash-through-filebeat/88170/5 "2017-06-04T09:09:42Z")
Ohh..Thanks @Christian_Dahlqvist
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 2, 2017, 9:10am UTC](https://discuss.elastic.co/t/multiline-is-not-working-when-i-am-sending-logs-to-logstash-through-filebeat/88170/6 "2017-07-02T09:10:06Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.