# Multiline Pattern not Matching correctly

**URL:** <https://discuss.elastic.co/t/multiline-pattern-not-matching-correctly/94985>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [July 28, 2017, 3:24pm UTC](https://discuss.elastic.co/t/multiline-pattern-not-matching-correctly/94985 "2017-07-28T15:24:20Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![AlBytor](https://avatars.discourse-cdn.com/v4/letter/a/85e7bf/32.png) [@AlBytor](https://discuss.elastic.co/u/AlBytor)\
**Post date:** [July 28, 2017, 3:24pm UTC](https://discuss.elastic.co/t/multiline-pattern-not-matching-correctly/94985/1 "2017-07-28T15:24:20Z")

</div>

My current Filebeat configuration is:  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/f/7f0b043d5e4eb3b562eafdcf4dc52b15620f3012.png)

But it keeps combining all of them together:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/5/75bc556c7bb81cd737bcdd2ba9b11a666c2fe04e.png)

As you can see my pattern consists of one letter and numbers:  
2017-07-28T03:33:19.676-0500

Does anyone know what multiline.pattern would work best in this case?

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [July 28, 2017, 4:13pm UTC](https://discuss.elastic.co/t/multiline-pattern-not-matching-correctly/94985/2 "2017-07-28T16:13:45Z")

</div>

Have you tested your pattern as described [here](https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html#_testing_your_regexp_pattern_for_multiline)?

Please do not post screenshots when it's possible to copy and paste the content. (It makes more work for anyone that wishes to help by testing your pattern against the logs.)

---

<div class="post-metadata">

**Author:** ![AlBytor](https://avatars.discourse-cdn.com/v4/letter/a/85e7bf/32.png) [@AlBytor](https://discuss.elastic.co/u/AlBytor)\
**Post date:** [July 28, 2017, 5:12pm UTC](https://discuss.elastic.co/t/multiline-pattern-not-matching-correctly/94985/3 "2017-07-28T17:12:27Z")

</div>

I have not thank you for that information, I will give that a try.

Sorry for the screen shot here is the text for my screen shots:

```auto
filebeat.prospectors:
- input_type: log
  paths:
    - c:\hoppr\Logs\hoppr.mongosa.27017\mongod.log
  multiline.pattern: '^\[0-9]{4}-[0-9]{2}-[0-9]{2}'
  multiline.negate: true
  multiline.match: after  
  fields_under_root: true
  fields:
    type: mongodb
output.elasticsearch:
  hosts: ["http://172.19.90.87:9200"]
  index: hoppr-mongodb-%{+yyyy.MM.dd}

```

```auto
2017-06-19T02:58:46.558-0500 I NETWORK [initandlisten] waiting for connections on port 27017
2017-06-19T02:59:03.243-0500 I NETWORK [initandlisten] connection accepted from 127.0.0.1:49847 #1 (1 connection now open)
2017-06-19T02:59:03.980-0500 I NETWORK [initandlisten] connection accepted from 127.0.0.1:49850 #2 (2 connections now open)
2017-06-19T02:59:09.023-0500 I NETWORK [initandlisten] connection accepted from 127.0.0.1:49851 #3 (3 connections now open)

```

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [July 28, 2017, 7:17pm UTC](https://discuss.elastic.co/t/multiline-pattern-not-matching-correctly/94985/4 "2017-07-28T19:17:18Z")

</div>

Try modifying your pattern to `^[0-9]{4}-[0-9]{2}-[0-9]{2}` (remove the escaping from the first bracket).

---

<div class="post-metadata">

**Author:** ![AlBytor](https://avatars.discourse-cdn.com/v4/letter/a/85e7bf/32.png) [@AlBytor](https://discuss.elastic.co/u/AlBytor)\
**Post date:** [July 31, 2017, 3:35pm UTC](https://discuss.elastic.co/t/multiline-pattern-not-matching-correctly/94985/5 "2017-07-31T15:35:01Z")

</div>

Andrew that worked, thank you, it is matching correctly now.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 28, 2017, 3:35pm UTC](https://discuss.elastic.co/t/multiline-pattern-not-matching-correctly/94985/6 "2017-08-28T15:35:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.