# Multiline | Not even working

**URL:** <https://discuss.elastic.co/t/multiline-not-even-working/102963>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [October 6, 2017, 7:50am UTC](https://discuss.elastic.co/t/multiline-not-even-working/102963 "2017-10-06T07:50:22Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![WhipSnake](https://avatars.discourse-cdn.com/v4/letter/w/b3f665/32.png) [@WhipSnake](https://discuss.elastic.co/u/WhipSnake)\
**Post date:** [October 6, 2017, 7:50am UTC](https://discuss.elastic.co/t/multiline-not-even-working/102963/1 "2017-10-06T07:50:22Z")

</div>

I have having difficulty getting the below multiline code to work. I feel I am close just no sure what I am doing wrong. I want it to take the lines that don't have time stamps and append it to the time stamp that is above it. I had read in another post that spaces and such in the .yml are important and I made sure mine were ok. Filebeat does run and it sends the stuff to logstash but for some reason when I look in Kibana the logs are being split.

Config File:

```auto
filebeat.prospectors:

- input_type: log

  # Paths that should be crawled and fetched. Glob based paths.
  paths:
    - E:\AOLogs\grid.log

multiline:
  pattern: '\d{1,2}\s+(Jan(uary)?|Feb(ruary)?|Mar(ch)?|Apr(il)?|May|Jun(e)?|Jul(y)?|Aug(ust)?|Sep(tember)?|Oct(ober)?|Nov(ember)?|Dec(ember)?)\s\d{4}\s\d{2}:\d{2}:\d{2},\d{3}'
  negate: true
  match: after

#================================ General =====================================

name: DevAO

#================================ Outputs =====================================

# Configure what outputs to use when sending the data collected by the beat.
# Multiple outputs may be used.

output.logstash:
  # The Logstash hosts
 hosts: ["Server.Domain.Hidden:5044"]

#================================ Logging =====================================

logging.level: debug

logging.selectors: ["*"]

```

Sample Log File:

```auto
06 Oct 2017 02:45:17,261 [Thread=AMP - Activity Processor - Parallel Adapter Invocation Worker - 6272000] DEBUG AdapterManager [PeerName=CDP] [JobID=b518a7772085ac34:-7822094:15e28c16e22:-7ff61-1507275916300] [AdapterName=IPNOPSHA_DB] unsetMDC(AdapterRequest)
06 Oct 2017 02:45:17,261 [Thread=AMP - Activity Processor - Parallel Adapter Invocation Worker - 6272000] DEBUG AdapterManager [PeerName=CDP] Thread [42150793] - Received response from local adapter "AdapterConfiguration1488257317210--650700716" : <adapter-response><execution-duration>2</execution-duration><status>success</status><messageBase64></messageBase64><peer-name>CDP</peer-name><data><sqlAdapterResponse><metadata><queryExecuted>UPDATE AO.Shadow_ipnops_blackout
SET b_move_to_queue = 1,
new_assignment_group = 'ipnops-automation',
b_update_ticket = 1,
touch_count = 1,
b_override = 1,
ticket_update = '' + Convert(nvarchar,GETDATE(),120) + ' (Shadow-Master_ipnops_blackout): Moving to ipnops-automation ' + CHAR(13) + CHAR(10) + '---' + CHAR(13) + CHAR(10) + ticket_update
WHERE ( ( ( alert1 = 'NT_CPU') OR ( (alert1 like 'NT_LOGICAL_DISK%') ) OR ( alert2 like 'PA:%') OR ( (alert1 in (select t.a1 from (SELECT alert1 as a1, alert2 as a2, alert3 as a3 FROM ao.Patrol_CLI_Master_Alert1) t where (a2 is null or a2 = alert2) and (a3 is null or a3 = alert3)))) OR ( (alert1 = 'ping' or alert3 = 'Availability') and CI_Type not in ('router', 'Router', 'circuit', 'Circuit') and alert1 != 'Interface') OR ( alert1 = 'NT_SERVICES' or alert1 = 'NT_Service') )) AND (Affected_CI NOT IN (SELECT Affected_CI FROM AO.BlackOut_Task WHERE GETDATE() between Start_Time_Moline and End_Time_Moline)) AND NOT (( 1 = 0 )) </queryExecuted><execution-milliseconds>2</execution-milliseconds><status>success</status></metadata></sqlAdapterResponse></data></adapter-response>
06 Oct 2017 02:45:17,261 [Thread=AMP - Activity Processor - Parallel Adapter Invocation Worker - 6272000] DEBUG AdapterManager [PeerName=CDP] Request succeeded, adding entry for peer named [CDP] in adapter-job cache for adapter name [IPNOPSHA_DB] and job ID [[JobID representation=b518a7772085ac34:-7822094:15e28c16e22:-7ff61-1507275916300, timestamp=Fri Oct 06 02:45:16 CDT 2017]].
06 Oct 2017 02:45:17,261 [Thread=AMP - Activity Processor - Parallel Adapter Invocation Worker - 6272000] DEBUG AdapterManager [PeerName=CDP] returning response <adapter-response><execution-duration>2</execution-duration><status>success</status><messageBase64></messageBase64><peer-name>CDP</peer-name><data><sqlAdapterResponse><metadata><queryExecuted>UPDATE AO.Shadow_ipnops_blackout
SET b_move_to_queue = 1,
new_assignment_group = 'ipnops-automation',
b_update_ticket = 1,
touch_count = 1,
b_override = 1,
ticket_update = '' + Convert(nvarchar,GETDATE(),120) + ' (Shadow-Master_ipnops_blackout): Moving to ipnops-automation ' + CHAR(13) + CHAR(10) + '---' + CHAR(13) + CHAR(10) + ticket_update
WHERE ( ( ( alert1 = 'NT_CPU') OR ( (alert1 like 'NT_LOGICAL_DISK%') ) OR ( alert2 like 'PA:%') OR ( (alert1 in (select t.a1 from (SELECT alert1 as a1, alert2 as a2, alert3 as a3 FROM ao.Patrol_CLI_Master_Alert1) t where (a2 is null or a2 = alert2) and (a3 is null or a3 = alert3)))) OR ( (alert1 = 'ping' or alert3 = 'Availability') and CI_Type not in ('router', 'Router', 'circuit', 'Circuit') and alert1 != 'Interface') OR ( alert1 = 'NT_SERVICES' or alert1 = 'NT_Service') )) AND (Affected_CI NOT IN (SELECT Affected_CI FROM AO.BlackOut_Task WHERE GETDATE() between Start_Time_Moline and End_Time_Moline)) AND NOT (( 1 = 0 )) </queryExecuted><execution-milliseconds>2</execution-milliseconds><status>success</status></metadata></sqlAdapterResponse></data></adapter-response>
06 Oct 2017 02:45:17,411 [Thread=AMP - Activity Processor - Parallel Adapter Invocation Worker - 6272001] DEBUG AdapterManager [PeerName=CDP] mapped IPNOPSHA_DB to AdapterConfiguration1488257317210--650700716
06 Oct 2017 02:45:17,411 [Thread=AMP - Activity Processor - Parallel Adapter Invocation Worker - 6272001] DEBUG AdapterManager [PeerName=CDP] Received request to perform action on [IPNOPSHA_DB].

```

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [October 6, 2017, 10:50am UTC](https://discuss.elastic.co/t/multiline-not-even-working/102963/2 "2017-10-06T10:50:44Z")

</div>

Please properly format config files and logs using the `</>` button.

The multiline setting should be part of the prospector setting, not global.

---

<div class="post-metadata">

**Author:** ![WhipSnake](https://avatars.discourse-cdn.com/v4/letter/w/b3f665/32.png) [@WhipSnake](https://discuss.elastic.co/u/WhipSnake)\
**Post date:** [October 6, 2017, 12:48pm UTC](https://discuss.elastic.co/t/multiline-not-even-working/102963/3 "2017-10-06T12:48:53Z")

</div>

That worked they should plaster this doc more places for idiot first timers

[https://www.elastic.co/guide/en/beats/libbeat/current/config-file-format.html](https://www.elastic.co/guide/en/beats/libbeat/current/config-file-format.html)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 3, 2017, 12:48pm UTC](https://discuss.elastic.co/t/multiline-not-even-working/102963/4 "2017-11-03T12:48:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.