# Multiline log parsing - Filebeat, Logstash **URL:** \ **Category:** Logstash\ **Created:** [June 15, 2020, 12:06pm UTC](https://discuss.elastic.co/t/multiline-log-parsing-filebeat-logstash/237132 "2020-06-15T12:06:52Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Gyanprakash\_Mishra](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gyanprakash_mishra/32/70389_2.png) [@Gyanprakash\_Mishra](https://discuss.elastic.co/u/Gyanprakash_Mishra)\ **Post date:** [June 15, 2020, 12:06pm UTC](https://discuss.elastic.co/t/multiline-log-parsing-filebeat-logstash/237132/1 "2020-06-15T12:06:52Z")
Hi All, I am using filebeat to stash data into logstash. Need help in parsing log of following format: 11-Jun-2020 18:31:51.900 SEVERE [http-nio-8080-exec-24] org.apache.catalina.core.StandardWrapperValve.invoke Servlet.service() for servlet [sirionlabs] in context with path threw exception com.sirionlabs.exception.InvalidURLException at com.sirionlabs.security.util.RequestUtils.buildTenentMap(RequestUtils.java:55) at com.sirionlabs.bservice.security.filter.TenantSecurityFilter.doFilter(TenantSecurityFilter.java:64) at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342) at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:192) at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:160) at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:347) at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:263) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) at com.sirionlabs.filter.ResponseTimeFilter.doFilter(ResponseTimeFilter.java:35) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:198) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96) at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:504) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:140) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:81) at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:650) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:87) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:342) at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:803) at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66) at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:790) at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1459) at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1167) at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:641) at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) at java.base/java.lang.Thread.run(Thread.java:844) 11-Jun-2020 18:31:51.914 SEVERE [http-nio-8080-exec-32] org.apache.catalina.core.StandardWrapperValve.invoke Servlet.service() for servlet [sirionlabs] in context with path threw exception com.sirionlabs.exception.InvalidURLException at com.sirionlabs.security.util.RequestUtils.buildTenentMap(RequestUtils.java:55) at com.sirionlabs.bservice.security.filter.TenantSecurityFilter.doFilter(TenantSecurityFilter.java:64) at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342) at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:192) at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:160) at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:347) at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:263) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) at com.sirionlabs.filter.ResponseTimeFilter.doFilter(ResponseTimeFilter.java:35) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:198) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96) at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:504) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:140) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:81) at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:650) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:87) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:342) at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:803) at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66) at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:790) at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1459) at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1167) at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:641) at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) at java.base/java.lang.Thread.run(Thread.java:844) ---
**Author:** ![Wolfram\_Haussig](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wolfram_haussig/32/70528_2.png) [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)\ **Post date:** [June 17, 2020, 10:35am UTC](https://discuss.elastic.co/t/multiline-log-parsing-filebeat-logstash/237132/2 "2020-06-17T10:35:20Z")
Hi, The first step would be to configure FileBeat to configure filebeat to recognise [multiline logs](https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html), e.g.: multiline.pattern: ^\d?\d-\w\w\w-\d\d\d\d multiline.negate: true multiline.match: after This will rrecognise the start of a new entry based on the date format at the beginning of each line. Next, I would start building a suitable Grok pattern - Kibana is really helpful for that: Go to the Dev Tools in Kibana and choose [Grok Debugger](https://www.elastic.co/guide/en/kibana/current/xpack-grokdebugger.html). There, you can enter your example log and develop your Grok pattern until it works as expected. Best regards Wolfram ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 15, 2020, 10:35am UTC](https://discuss.elastic.co/t/multiline-log-parsing-filebeat-logstash/237132/3 "2020-07-15T10:35:27Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.