# Multiline logs

**URL:** https://discuss.elastic.co/t/multiline-logs/282835
**Category:** Beats
**Tags:** filebeat
**Created:** [August 30, 2021, 2:59pm UTC](https://discuss.elastic.co/t/multiline-logs/282835 "2021-08-30T14:59:11Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![111360](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/111360/32/45037_2.png) [@111360](https://discuss.elastic.co/u/111360)
#### Post date: [August 30, 2021, 2:59pm UTC](https://discuss.elastic.co/t/multiline-logs/282835/1 "2021-08-30T14:59:11Z")

</div>

In filebeat config:  
multiline.type: pattern  
multiline.pattern: '^['  
multiline.negate: true  
multiline.match: after  
From [Manage multiline messages | Filebeat Reference [7.14] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html) and test log  
'''  
[beat-logstash-some-name-832-2015.11.28] IndexNotFoundException[no such index]  
at org.elasticsearch.cluster.metadata.IndexNameExpressionResolver$WildcardExpressionResolver.resolve(IndexNameExpressionResolver.java:566)  
at org.elasticsearch.cluster.metadata.IndexNameExpressionResolver.concreteIndices(IndexNameExpressionResolver.java:133)  
at org.elasticsearch.cluster.metadata.IndexNameExpressionResolver.concreteIndices(IndexNameExpressionResolver.java:77)  
at org.elasticsearch.action.admin.indices.delete.TransportDeleteIndexAction.checkBlock(TransportDeleteIndexAction.java:75)  
'''  
In elastic each line other message. Filebeat: 7.14.0

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [August 30, 2021, 11:46pm UTC](https://discuss.elastic.co/t/multiline-logs/282835/2 "2021-08-30T23:46:52Z")

</div>

It's not clear what you are asking for here sorry.

---

<div class="post-metadata">

### Author: ![111360](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/111360/32/45037_2.png) [@111360](https://discuss.elastic.co/u/111360)
#### Post date: [August 31, 2021, 7:19am UTC](https://discuss.elastic.co/t/multiline-logs/282835/3 "2021-08-31T07:19:34Z")

</div>

> [@warkolm](#):
>
> It's not clear what you are asking for here sorry.

It's not clear what you are asking for here sorry. I took the config from the off site, and an example of the log. The example of the config itself, and the log sent in the subject.  
But in ELK, they are different messages.  
What could be the problem?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 28, 2021, 9:20am UTC](https://discuss.elastic.co/t/multiline-logs/282835/4 "2021-09-28T09:20:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.