# Multiline logs

**URL:** <https://discuss.elastic.co/t/multiline-logs/362166>\
**Category:** Elastic Agent\
**Created:** [June 27, 2024, 1:43pm UTC](https://discuss.elastic.co/t/multiline-logs/362166 "2024-06-27T13:43:27Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![adis3421](https://avatars.discourse-cdn.com/v4/letter/a/46a35a/32.png) [@adis3421](https://discuss.elastic.co/u/adis3421)\
**Post date:** [June 27, 2024, 1:43pm UTC](https://discuss.elastic.co/t/multiline-logs/362166/1 "2024-06-27T13:43:27Z")

</div>

Hi,  
I use custom logs integration to process custom logs, but this integration does not connect the multi-lines below: Custom logs configuration and sample log.  
Config in Custom Log:  
filebeat.inputs:

- type: filestream  
enabled: true  
paths:
  - /data/tomcat/logs/server.log\*  
parsers:
  - multiline:  
type: pattern  
pattern: '\[1\]{2}:[0-9]{2}:[0-9]{2}.[0-9]{3}'  
negate: true  
match: after  
Example log:  
08:47:23.519 [cdad0e83-ee52-4891-8705-e67a878912e8] [INFO] [interceptor.RequestAndResponseLoggingFilter] [http-nio-8080-exec-13] :  
-- RESPONSE --  
716b4394-11e4-4b87-8604-4cc8d0359801|\< 200 OK  
716b4394-11e4-4b87-8604-4cc8d0359801|\<  
716b4394-11e4-4b87-8604-4cc8d0359801|\< body:  
716b4394-11e4-4b87-8604-4cc8d0359801|\< {"customerSearchCrmPOSTResponseBody":{"results":[{"customer":{"status":"Active","creationDate":"2023-05-12","customerId":30541,"customerType":"Company","companyName":"Wilderman, Pfeffer and Greenfelder","companyOwnName":"Wilderman, Pfeffer and Greenfelder","companyLegalFormCode":"State","identificationCountryCode":"PL","identificationNumber":"3743815847","identificationType":"NIP"},"address":{"addressId":70769,"countryCode":"PL","postCode":"80-721","city":"GDAŃSK","street":"PROSTA","buildingNumber":"1","addressType":"Main"},"contactDetails":{"[mainEmailAddress":"xxxxx@gmail.com](mailto:mainEmailAddress%22:%22xxxxx@gmail.com)","mainPhoneNumber":"888999777"}}],"searchParams":{"offset":0,"limit":10,"total":1,"andOrOperator":"and","sortOrder":"asc"}},"commonResponse":{"commonResponseBody":{"requestId":"cdad0e83-ee52-4891-8705-e67a878912e8","responseId":"1748ebe7dfb8e5"}}}

* * *

1. 0-9

---

<div class="post-metadata">

**Author:** ![adis3421](https://avatars.discourse-cdn.com/v4/letter/a/46a35a/32.png) [@adis3421](https://discuss.elastic.co/u/adis3421)\
**Post date:** [June 28, 2024, 7:55am UTC](https://discuss.elastic.co/t/multiline-logs/362166/2 "2024-06-28T07:55:37Z")

</div>

Ok its working with this config in custom configuration:  
multiline:  
type: pattern  
pattern: '\[1\]{2}:[0-9]{2}:[0-9]{2}.[0-9]{3}'  
negate: true  
match: after

* * *

1. 0-9