# Multiline Parsing

**URL:** <https://discuss.elastic.co/t/multiline-parsing/101717>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [September 25, 2017, 2:14pm UTC](https://discuss.elastic.co/t/multiline-parsing/101717 "2017-09-25T14:14:47Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![omer](https://avatars.discourse-cdn.com/v4/letter/o/258eb7/32.png) [@omer](https://discuss.elastic.co/u/omer)\
**Post date:** [September 25, 2017, 2:14pm UTC](https://discuss.elastic.co/t/multiline-parsing/101717/1 "2017-09-25T14:14:47Z")

</div>

Hi,

I am trying to parse a multiline log file. Input comes from filebeat so i must use multiline settings at filebeat.yml. I searched for examples and made a configuration like that:

```auto
multiline.pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}'
multiline.negate: true
multiline.match: after

```

And here is my sample log file:

```auto
2017-09-21 11:32:05,361 INFO [gov.nist.javax.sip.stack.SIPTransactionStack][dsipua-UDPMessageChannelThread-8] <message
from="10.6.64.110:5060" 
to="10.6.194.4:5060" 
time="1505971925361"
isSender="false" 
transactionId="z9hg4bk-373338-4e04f0bad7d0c0e443cda42f37f878fe" 
callId="d7ad85cc2c5f2ed0b28a6f11cb96b4e0@10.6.194.4" 
firstLine="SIP/2.0 100 Trying" 
>
<![CDATA[SIP/2.0 100 Trying
From: <sip:+000@10.6.194.4>;tag=3fe7bcf
To: <sip:+77784873684@ALMAS6.KCELL.KZ>
Via: SIP/2.0/UDP 10.6.194.4:5060;branch=z9hG4bK-373338-4e04f0bad7d0c0e443cda42f37f878fe;received=10.6.194.4
Call-ID: d7ad85cc2c5f2ed0b28a6f11cb96b4e0@10.6.194.4
CSeq: 1 INVITE
Content-Length: 0

]]>
</message>

```

However; filebeat sends them as seperate lines. Need help for this. 😥

Thank you 😃

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [September 26, 2017, 2:11pm UTC](https://discuss.elastic.co/t/multiline-parsing/101717/2 "2017-09-26T14:11:47Z")

</div>

Double check that you have specified the multiline options in the proper location. I tested your multiline config against the sample log and it worked for me. The config should be intended like so:

```auto
filebeat.prospectors:
- paths:
    - 'input.log'
  multiline.pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}'
  multiline.negate: true
  multiline.match: after

```

(the important part is that `multiline` is at the same level as `paths` and the other prospector options)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 24, 2017, 2:12pm UTC](https://discuss.elastic.co/t/multiline-parsing/101717/3 "2017-10-24T14:12:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.