# Multiline - multiple level of multiline in Filebeat **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [March 10, 2020, 7:20am UTC](https://discuss.elastic.co/t/multiline-multiple-level-of-multiline-in-filebeat/222875 "2020-03-10T07:20:53Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![aviman](https://avatars.discourse-cdn.com/v4/letter/a/eada6e/32.png) [@aviman](https://discuss.elastic.co/u/aviman)\ **Post date:** [March 10, 2020, 7:20am UTC](https://discuss.elastic.co/t/multiline-multiple-level-of-multiline-in-filebeat/222875/1 "2020-03-10T07:20:53Z")
Hi, Can we use multiple level of multiline feature in Filebeat. Input --\> multiline (to join based on 1st pattern) --\> processor(drop lines based on condition) --\>multiline (to join based on 2pattern) Input : 0 STARTED Thu Jan 30 22:48:00 2020 Starting process1 1 INFO Thu Jan 30 22:48:01 2020 process1 variable 2 STARTED Thu Jan 30 22:53:35 2020 process1 aborted. Output (line to be send to Logstash) 1. Multiline ouput |0|STARTED|Thu Jan 30 22:48:00 2020\n\tStarting process1| |---|---|---| |1|INFO|Thu Jan 30 22:48:01 2020\n\tprocess1 variable| |2|STARTED|Thu Jan 30 22:53:35 2020\n\tprocess1 aborted.| 2. Processor output (Removing INFO) |0|STARTED|Thu Jan 30 22:48:00 2020\n\tStarting process1| |---|---|---| |2|STARTED|Thu Jan 30 22:53:35 2020\n\tprocess1 aborted.| Till above I could achieve Now next wanted above line in multiline and get output - a single line: 0 STARTED Thu Jan 30 22:48:00 2020\n\tStarting process1\n2 STARTED Thu Jan 30 22:53:35 2020\n\tprocess1 aborted. Thanks & Regards, Avijit Madal ---
**Author:** ![mtojek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mtojek/32/63863_2.png) [@mtojek](https://discuss.elastic.co/u/mtojek)\ **Post date:** [March 10, 2020, 8:49am UTC](https://discuss.elastic.co/t/multiline-multiple-level-of-multiline-in-filebeat/222875/2 "2020-03-10T08:49:00Z")
Hi, could you please format your post using \ ? It's really hard to read log entries. ---
**Author:** ![aviman](https://avatars.discourse-cdn.com/v4/letter/a/eada6e/32.png) [@aviman](https://discuss.elastic.co/u/aviman)\ **Post date:** [March 10, 2020, 9:34am UTC](https://discuss.elastic.co/t/multiline-multiple-level-of-multiline-in-filebeat/222875/4 "2020-03-10T09:34:50Z")
## ----My Log--- (starting values 0,1,2..represent log lines spread into multiple lines) 0 STARTED Thu Jan 30 22:48:00 2020 Starting process1 1 INFO Thu Jan 30 22:48:01 2020 process1 variable 2 STARTED Thu Jan 30 22:53:35 2020 process1 aborted. Expected output to logstash 0 STARTED Thu Jan 30 22:48:00 2020 Starting process1 2 STARTED Thu Jan 30 22:53:35 2020 process1 aborted. ---
**Author:** ![aviman](https://avatars.discourse-cdn.com/v4/letter/a/eada6e/32.png) [@aviman](https://discuss.elastic.co/u/aviman)\ **Post date:** [March 12, 2020, 4:01am UTC](https://discuss.elastic.co/t/multiline-multiple-level-of-multiline-in-filebeat/222875/5 "2020-03-12T04:01:19Z")
Hi Marcin, Let me know if second post makes it clear. If not will try to rewrite the issue. Thanks ---
**Author:** ![mtojek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mtojek/32/63863_2.png) [@mtojek](https://discuss.elastic.co/u/mtojek)\ **Post date:** [March 12, 2020, 8:04am UTC](https://discuss.elastic.co/t/multiline-multiple-level-of-multiline-in-filebeat/222875/6 "2020-03-12T08:04:14Z")
Please rethink if you really need to build complex processing expressions. It makes it harder to maintain. It's easier sometimes to use a script processors: [https://www.elastic.co/guide/en/beats/filebeat/master/processor-script.html](https://www.elastic.co/guide/en/beats/filebeat/master/processor-script.html) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 9, 2020, 8:04am UTC](https://discuss.elastic.co/t/multiline-multiple-level-of-multiline-in-filebeat/222875/7 "2020-04-09T08:04:21Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.