# Multiline kernel panic log parsing by filebeat

**URL:** <https://discuss.elastic.co/t/multiline-kernel-panic-log-parsing-by-filebeat/264824>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [February 19, 2021, 9:21am UTC](https://discuss.elastic.co/t/multiline-kernel-panic-log-parsing-by-filebeat/264824 "2021-02-19T09:21:51Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kuo\_Hugo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kuo_hugo/32/1641_2.png) [@Kuo\_Hugo](https://discuss.elastic.co/u/Kuo_Hugo)\
**Post date:** [February 19, 2021, 9:21am UTC](https://discuss.elastic.co/t/multiline-kernel-panic-log-parsing-by-filebeat/264824/1 "2021-02-19T09:21:51Z")

</div>

I have hard time to index the kernel panic logs by filebeat as below example.

- Do you have suggestion about the best option to index Linux kernel logs?
- I don't see an option to handle the multiline logs as the kernel panic log. Does anyone experience with this?

```auto
[12193263.407267] nr_pdflush_threads exported in /proc is scheduled for removal
[16890791.711563] INFO: task systemd-logind:19251 blocked for more than 120 seconds.
[16890791.719063] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[16890791.727165] systemd-logind D ffff8cff993e5140 0 19251 1 0x00000080
[16890791.727177] Call Trace:
[16890791.727195] [<ffffffff9cf67bc9>] ? schedule+0x29/0x70
[16890791.727206] [<ffffffff9cf67bc9>] schedule+0x29/0x70
[16890791.727215] [<ffffffff9cf694b5>] rwsem_down_write_failed+0x225/0x3a0
[16890791.727227] [<ffffffff9cb869d7>] call_rwsem_down_write_failed+0x17/0x30
[16890791.727234] [<ffffffff9cf66ecd>] down_write+0x2d/0x3d
[16890791.727245] [<ffffffff9c9c9039>] unregister_shrinker+0x19/0x40
[16890791.727254] [<ffffffff9ca442f1>] deactivate_locked_super+0x41/0x70
[16890791.727260] [<ffffffff9ca44a86>] deactivate_super+0x46/0x60
[16890791.727269] [<ffffffff9ca62fff>] cleanup_mnt+0x3f/0x80
[16890791.727276] [<ffffffff9ca63092>] __cleanup_mnt+0x12/0x20
[16890791.727287] [<ffffffff9c8be79b>] task_work_run+0xbb/0xe0
[16890791.727296] [<ffffffff9c82bc65>] do_notify_resume+0xa5/0xc0
[16890791.727307] [<ffffffff9cf75124>] int_signal+0x12/0x17

```

Thanks // Hugo

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 19, 2021, 11:22am UTC](https://discuss.elastic.co/t/multiline-kernel-panic-log-parsing-by-filebeat/264824/2 "2021-03-19T11:22:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.