# Multiline.pattern does not search for start with when the pattern has a string

**URL:** <https://discuss.elastic.co/t/multiline-pattern-does-not-search-for-start-with-when-the-pattern-has-a-string/186971>\
**Category:** Beats\
**Created:** [June 22, 2019, 8:15pm UTC](https://discuss.elastic.co/t/multiline-pattern-does-not-search-for-start-with-when-the-pattern-has-a-string/186971 "2019-06-22T20:15:00Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![KRISHNA\_SINHA](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/krishna_sinha/32/45409_2.png) [@KRISHNA\_SINHA](https://discuss.elastic.co/u/KRISHNA_SINHA)\
**Post date:** [June 22, 2019, 8:15pm UTC](https://discuss.elastic.co/t/multiline-pattern-does-not-search-for-start-with-when-the-pattern-has-a-string/186971/1 "2019-06-22T20:15:01Z")

</div>

I have a log file. From this log file I need to separate the entries based on following pattern multiline.pattern: '^{"EntryDate'  
multiline.negate: false  
multiline.match: after

The output I am expecting is that Filebeat will separate the entries whenever it sees the line starting with {ËntryDate, but it does not do the same. It seems it does not honour the complete string and uses only the first character. In this case it is "{".

Sample File  
{"EntryDate":"2019-06-21 20:42:06,777","correlationid":"(null)","level":"INFO ","Application":"VHQ NA","HostName":"blr2krishnas3","Component":"VHQDataService","customername": "(null)","username":"(null)","deviceuid":"(null)","deviceid":"(null)","serialnumber":"(null)","model":"(null)","classname":"System.Threading.Tasks.Task","method":"Execute","message":"Successfully executed."}  
{"EntryDate":"2019-06-21 20:42:06,777","correlationid":"(null)","level":"DEBUG","Application":"VHQ NA","HostName":"blr2krishnas3","Component":"VHQDataService","customername": "(null)","username":"(null)","deviceuid":"(null)","deviceid":"(null)","serialnumber":"(null)","model":"(null)","classname":"System.Threading.Tasks.Task","method":"Execute","message":"Called."}  
{"EntryDate":"2019-06-21 20:42:06,778","correlationid":"(null)","level":"DEBUG","Application":"VHQ NA","HostName":"blr2krishnas3","Component":"VHQDataService","customername": "(null)","username":"(null)","deviceuid":"(null)","deviceid":"(null)","serialnumber":"(null)","model":"(null)","classname":"System.Threading.Tasks.Task","method":"Execute","message":"IsPrivilegedUser called."}  
{"EntryDate":"2019-06-21 20:42:06,778","correlationid":"(null)","level":"INFO ","Application":"VHQ NA","HostName":"blr2krishnas3","Component":"VHQDataService","customername": "(null)","username":"(null)","deviceuid":"(null)","deviceid":"(null)","serialnumber":"(null)","model":"(null)","classname":"System.Threading.Tasks.Task","method":"Execute","message":"PrivilegedUser called"}  
{"EntryDate":"2019-06-21 20:42:06,769","correlationid":"(null)","level":"INFO ","Application":"VHQ NA","HostName":"blr2krishnas3","Component":"VHQDataService","customername": "(null)","username":"(null)","deviceuid":"(null)","deviceid":"(null)","serialnumber":"(null)","model":"(null)","classname":"System.Threading.Tasks.Task","method":"Execute","message":"TokenGuid : 9b607313-16a1-4d89-bc31-58ecc93f20d3 - [UserName:sqm.syed096@gmail.com](mailto:UserName:sqm.syed096@gmail.com)"}  
{"EntryDate":"2019-06-21 20:42:06,778","correlationid":"(null)","level":"DEBUG","Application":"VHQ NA","HostName":"blr2krishnas3","Component":"VHQDataService","customername": "(null)","username":"(null)","deviceuid":"(null)","deviceid":"(null)","serialnumber":"(null)","model":"(null)","classname":"System.Threading.Tasks.Task","method":"Execute","message":"IsPrivilegedUser is successful."}  
{"EntryDate":"2019-06-21 20:42:06,782","correlationid":"(null)","level":"INFO ","Application":"VHQ NA","HostName":"blr2krishnas3","Component":"VHQDataService","customername": "(null)","username":"(null)","deviceuid":"(null)","deviceid":"(null)","serialnumber":"(null)","model":"(null)","classname":"System.Threading.Tasks.Task","method":"Execute","message":"Successfully opened the database connection"}  
{"EntryDate":"2019-06-21 20:42:06,769","correlationid":"(null)","level":"INFO ","Application":"VHQ NA","HostName":"blr2krishnas3","Component":"VHQDataService","customername": "(null)","username":"(null)","deviceuid":"(null)","deviceid":"(null)","serialnumber":"(null)","model":"(null)","classname":"System.Threading.Tasks.Task","method":"Execute","message":"GetTokenDetails call over "}  
{"EntryDate":"2019-06-21 20:42:07,733","correlationid":"(null)","level":"DEBUG","Application":"VHQ NA","HostName":"blr2krishnas3","Component":"VHQDataService","customername": "(null)","username":"(null)","deviceuid":"(null)","deviceid":"(null)","serialnumber":"(null)","model":"(null)","classname":"System.Threading.Tasks.Task","method":"Execute","message":"correlationState for operationName GetLogs are as follows {}"}  
{"EntryDate":"2019-06-21 20:42:07,725","correlationid":"(null)","level":"DEBUG","Application":"VHQ NA","HostName":"blr2krishnas3","Component":"VHQDataService","customername": "(null)","username":"(null)","deviceuid":"(null)","deviceid":"(null)","serialnumber":"(null)","model":"(null)","classname":"System.Threading.Tasks.Task","method":"Execute","message":"outputs for operationName GetLogs are as follows { "StatusCode": 1, "StatusMessage": "Success", "AdditionalInfo": null}"}  
{"EntryDate":"2019-06-21 20:42:07,725","correlationid":"(null)","level":"DEBUG","Application":"VHQ NA","HostName":"blr2krishnas3","Component":"VHQDataService","customername": "(null)","username":"(null)","deviceuid":"(null)","deviceid":"(null)","serialnumber":"(null)","model":"(null)","classname":"System.Threading.Tasks.Task","method":"Execute","message":"outputs for operationName GetLogs are as follows "{\"Logs\":,\"PaginationResponse\":{\"TotalPages\":0,\"TotalRecords\":0}}""}

{"EntryDate":"2019-06-21 20:42:08,058","correlationid":"(null)","level":"DEBUG","Application":"VHQ NA","HostName":"blr2krishnas3","Component":"VHQDataService","customername": "(null)","username":"(null)","deviceuid":"(null)","deviceid":"(null)","serialnumber":"(null)","model":"(null)","classname":"System.Threading.Tasks.Task","method":"Execute","message":"Parameters passed for operationName GetLogs are as follows {}"}  
{"EntryDate":"2019-06-21 20:42:08,059","correlationid":"(null)","level":"DEBUG","Application":"VHQ NA","HostName":"blr2krishnas3","Component":"VHQDataService","customername": "(null)","username":"(null)","deviceuid":"(null)","deviceid":"(null)","serialnumber":"(null)","model":"(null)","classname":"System.Threading.Tasks.Task","method":"Execute","message":"Parameters passed for operationName GetLogs are as follows { "ColumnSortFilter": { "SortList": null, "FilterList": [{ "FilterColumn": "Level", "FilterValue": "ERROR", "ColumnType": null, "FilterValueOptional": null, "FilterTableColumn": null, "FilterDays": 0, "IsFixedDateRange": false }, { "FilterColumn": "Component", "FilterValue": "Device", "ColumnType": null, "FilterValueOptional": null, "FilterTableColumn": null, "FilterDays": 0, "IsFixedDateRange": false }, { "FilterColumn": "EntryDate", "FilterValue": "2018-06-05 09:15:00", "ColumnType": null, "FilterValueOptional": "2019-06-21 08:18:00", "FilterTableColumn": null, "FilterDays": 0, "IsFixedDateRange": false }], "GridId": "Logs" }, "Pagination": { "PageNumber": 1, "RowsPerPage": 50, "HighLightedItemId": null }}"}

Record which got inserted in Elasticsearch

 ![Capture](https://us1.discourse-cdn.com/elastic/original/3X/0/2/02d20cb357383e2f116b10f681728b213a530b22.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 20, 2019, 10:15pm UTC](https://discuss.elastic.co/t/multiline-pattern-does-not-search-for-start-with-when-the-pattern-has-a-string/186971/2 "2019-07-20T22:15:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.