# Multiline pattern in filebeat

**URL:** <https://discuss.elastic.co/t/multiline-pattern-in-filebeat/164186>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [January 14, 2019, 6:24pm UTC](https://discuss.elastic.co/t/multiline-pattern-in-filebeat/164186 "2019-01-14T18:24:21Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![shiv94](https://avatars.discourse-cdn.com/v4/letter/s/bc8723/32.png) [@shiv94](https://discuss.elastic.co/u/shiv94)\
**Post date:** [January 14, 2019, 6:24pm UTC](https://discuss.elastic.co/t/multiline-pattern-in-filebeat/164186/1 "2019-01-14T18:24:21Z")

</div>

Hi All,

what would be the multi-line pattern for

\</ds:Reference\>  
\</ds:SignedInfo\>  
ds:SignatureValue  
attxcej7XBJ3rqWc9V0FbQwLLtBA7qvdNVmyErRANDUUrTpaxQCOaD8D4PpnVBaTCvana8RGLI1Q  
AvHgqjaDk6qoBbS27Knznku+T02TbKXAi7TfD8+glAhTIt59VZ68dGlkDO3Aau6CMq0TGiGymSbq  
2JjS8Sm4BjSAZDhgvZ087OVo8vHZqknXM05wvt4RRXhfxudmpliZmF1yhmQ13+oOX64gJb3lXnhF  
eopGdJhWkWGVu4l6M7QXroTtJ6qaj9HiRoexUeCX2w7VWCRJH6H1YK6d/z89Cip7LDSle0Xy9+KG  
lHmJXo0sC9WlyxysQu0nM7BK0Acny/giq3DuPg==  
\</ds:SignatureValue\>  
ds:KeyInfods:X509Datads:X509CertificateMIIDSzCCAjOgAwIBAgIUJ1fGLjazcb1hWl+0w+XJ2Gmk0LMwDQYJKoZIhvcNAQELBQAwIzEhMB8G  
A1UEAwwYc3NvLmFuZG92ZXJjb21wYW5pZXMubmV0MB4XDTE3MTIwODIxMzAwMVoXDTM3MTIwODIx  
MzAwMVowIzEhMB8GA1UEAwwYc3NvLmFuZG92ZXJjb21wYW5pZXMubmV0MIIBIjANBgkqhkiG9w0B  
AQEFAAOCAQ8AMIIBCgKCAQEAwKiNvsXY4jVGC40xfJ3S98Mj4wmFYC93CkHKtGKE7ZfuFNoF4bxr  
XnUt/ZMOVxJF/1Szf4WVpQRYogNHWzpTwTrhVkfG8V0HlXzwht1330rHo4ixo2iKGj6XY6KgBfJ0  
ksOZ7oiCnQof+MDLA2PLyqeTKkPBV5dagN1/PwZoNhmveP6Qg9iWepvk0yAbzJRVSytHWnRtrCaq  
TBL8Nwo6TGpDZOfSmr17qlZjtUY3h0F9g9rDDO5hzVLD7+8HVJX9Ct69RSg9EW3f6Ziqz3v9jf5r  
w4ad0k5GYRfmAFzYcTj2U36xS9mJVCybC6nZo6bbg/+oaxOoUqx8wE/IEuEr6QIDAQABo3cwdTAd  
BgNVHQ4EFgQUn0HrIIpZwjvh8V4bxxqybR4okjcwVAYDVR0RBE0wS4IYc3NvLmFuZG92ZXJjb21w  
YW5pZXMubmV0hi9odHRwczovL3Nzby5hbmRvdmVyY29tcGFuaWVzLm5ldC9pZHAvc2hpYmJvbGV0  
aDANBgkqhkiG9w0BAQsFAAOCAQEAYEorGjFzS46N2n3xs2b9goRTpZ7yHK46K6U/KiJcRq4k5LZd  
otFe24OOYglFvQBTq9PIQJwk1Mxxzhm0OXZoGnWnhYl4yVQttg9YVKzV5r/Psx3RTFzq/T6zvZF+  
WvdX1LLCpMThErlhdpqMPnAd1oG9SuUp1EfyF30lS/2VfLOkr32OOw6FYe+W00yorTxXu6aBcGEl  
4ea0cLp6gECQZSnLZ/rLqlUIYVg6QZ3gkxvXhhcnG74CZBzdfOro3fpj/+fH6YLWht5DXqkDScsx

because it reads individual line as seperate index. How to get all the lines in one message field or accept all type of alphabets or symbols? Can I use (.|\n)\* ?

---

<div class="post-metadata">

**Author:** ![shaunak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shaunak/32/6643_2.png) [@shaunak](https://discuss.elastic.co/u/shaunak)\
**Post date:** [January 15, 2019, 5:23am UTC](https://discuss.elastic.co/t/multiline-pattern-in-filebeat/164186/2 "2019-01-15T05:23:29Z")

</div>

Have you tried experimenting with the multiline options documented at [https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html](https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html)? What you have tried so far? What results did you get?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 12, 2019, 5:23am UTC](https://discuss.elastic.co/t/multiline-pattern-in-filebeat/164186/3 "2019-02-12T05:23:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.