# Multiline matching not working as aspected

**URL:** <https://discuss.elastic.co/t/multiline-matching-not-working-as-aspected/143989>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [August 11, 2018, 5:52pm UTC](https://discuss.elastic.co/t/multiline-matching-not-working-as-aspected/143989 "2018-08-11T17:52:53Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![shani\_angarkadu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shani_angarkadu/32/50638_2.png) [@shani\_angarkadu](https://discuss.elastic.co/u/shani_angarkadu)\
**Post date:** [August 11, 2018, 5:52pm UTC](https://discuss.elastic.co/t/multiline-matching-not-working-as-aspected/143989/1 "2018-08-11T17:52:53Z")

</div>

I have tried all the combinations of multiline.

multiline.pattern: '^([0-9]{4})-([0-1][0-9])-([0-3][0-9])\s([0-1][0-9]|[2][0-3]):([0-5][0-9]):([0-5][0-9])$' //timestamp pattern  
multiline.negate: true  
multiline.match: after  
taking all the lines as single line.

logs:

```auto
2018-12-02 00:06:50,395 SELECT DISTINCT eiup.login_id AS LoginId, up.is_super_user AS IsSuperUserCode,
      CASE WHEN up.is_super_user = 1 THEN 1 ELSE up.is_pie_user END AS IsPieUserCode,
            up.last_used_portfolio_id AS LastUsedPortfolio,
            WHERE eiup.login_id = :login_id <<INFO Nete.Ireport.Data.AppDbContext [t15]>>
2018-12-02 04:55:32,466 Response #63669473732326094014 for GET http://app/rest/competingappls/council?supplements=true&ic=OD <<INFO asssdds.Infrastructure.MessageLoggingInterceptor [t18]>>
2018-12-02 05:51:35,059 Request of sadada #6366947709505949325: GET http://app/rest/competingappls?loginId=BERNHARDEJ <<INFO asssasdsdad.Infrastructure.MessageLoggingInterceptor [t33]>>
2018-12-02 05:51:35,450 Opened connection at 8/10/2018 5:51:35 AM -04:00 <<INFO Data.AppDbContext [t33]>>
2018-12-02 05:51:35,450 Opened connection at 8/10/2018 5:51:35 AM -04:00 <<INFO .Data.AppDbContext [t33]>>

```

please help me. I have been trying from days.

Thanks,  
Ram

---

<div class="post-metadata">

**Author:** ![Debashis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/debashis/32/45290_2.png) [@Debashis](https://discuss.elastic.co/u/Debashis)\
**Post date:** [August 13, 2018, 6:10am UTC](https://discuss.elastic.co/t/multiline-matching-not-working-as-aspected/143989/2 "2018-08-13T06:10:06Z")

</div>

Hello @shani_angarkadu,

I think you want to create a multiline event that will consist lines from Line-1 to Line-4  
and the rest Line-5 to Line-8 will be published as a single line event as per you suggested logs.

If my understanding is correct then you can get it by configuring

> multiline.pattern: '\[1\]{4}-[0-9]{2}-[0-9]{2}'

Please let me know further

* * *

1. 0-9

---

<div class="post-metadata">

**Author:** ![shani\_angarkadu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shani_angarkadu/32/50638_2.png) [@shani\_angarkadu](https://discuss.elastic.co/u/shani_angarkadu)\
**Post date:** [August 14, 2018, 12:10am UTC](https://discuss.elastic.co/t/multiline-matching-not-working-as-aspected/143989/3 "2018-08-14T00:10:22Z")

</div>

thank you.

Actually, my pattern match was wrong.

Thanks again

---

<div class="post-metadata">

**Author:** ![Debashis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/debashis/32/45290_2.png) [@Debashis](https://discuss.elastic.co/u/Debashis)\
**Post date:** [August 14, 2018, 4:04am UTC](https://discuss.elastic.co/t/multiline-matching-not-working-as-aspected/143989/4 "2018-08-14T04:04:06Z")

</div>

Hi @shani_angarkadu,

Kindly Marked is as solved

---

<div class="post-metadata">

**Author:** ![Debashis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/debashis/32/45290_2.png) [@Debashis](https://discuss.elastic.co/u/Debashis)\
**Post date:** [August 16, 2018, 4:47am UTC](https://discuss.elastic.co/t/multiline-matching-not-working-as-aspected/143989/6 "2018-08-16T04:47:24Z")

</div>

Hi @shani_angarkadu,

This is the filebeat discussion forum kindly post this query in logstash dicussion forum. Please remove this query from here and mark this discussion as solved.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 13, 2018, 4:47am UTC](https://discuss.elastic.co/t/multiline-matching-not-working-as-aspected/143989/7 "2018-09-13T04:47:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.