# Multiline pattern not working in filebeat input\_type -filestream

**URL:** <https://discuss.elastic.co/t/multiline-pattern-not-working-in-filebeat-input-type-filestream/306947>\
**Category:** Kibana\
**Created:** [June 11, 2022, 9:53pm UTC](https://discuss.elastic.co/t/multiline-pattern-not-working-in-filebeat-input-type-filestream/306947 "2022-06-11T21:53:27Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![garry12](https://avatars.discourse-cdn.com/v4/letter/g/ac8455/32.png) [@garry12](https://discuss.elastic.co/u/garry12)\
**Post date:** [June 11, 2022, 9:53pm UTC](https://discuss.elastic.co/t/multiline-pattern-not-working-in-filebeat-input-type-filestream/306947/1 "2022-06-11T21:53:27Z")

</div>

I want to make multiline pattern work but the snipped I used below is working only when I change input\_type: log and NOT working with input\_type:filesteam can someone please help me what I should change to make multiline work?

`filebeat.inputs:`  
`- type: filestream`  
` enabled: true`  
` paths:`  
` - /.pss_filecore/2022/*/*/*/*.txt`  
` multiline.pattern: '^[[0-9]{4}-[0-9]{2}-[0-9]{2}-[0-9]{2}-[0-9]{2}-[0-9]{2}'`  
` multiline.negate: true`  
` multiline.match: after`  
` multiline.max_lines: 3500` `output.logstash:`  
` hosts: ["10.10.10.113:5044"]`

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [June 12, 2022, 1:56am UTC](https://discuss.elastic.co/t/multiline-pattern-not-working-in-filebeat-input-type-filestream/306947/2 "2022-06-12T01:56:45Z")

</div>

There is new syntax for multiline with the new filestream and 8.x.

Basically you're using the old syntax and your multiline is being ignored. You need to put it under the new `parsers` syntax

[`parsers`](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-filestream.html#_parsers)

---

<div class="post-metadata">

**Author:** ![garry12](https://avatars.discourse-cdn.com/v4/letter/g/ac8455/32.png) [@garry12](https://discuss.elastic.co/u/garry12)\
**Post date:** [June 12, 2022, 4:38pm UTC](https://discuss.elastic.co/t/multiline-pattern-not-working-in-filebeat-input-type-filestream/306947/3 "2022-06-12T16:38:39Z")

</div>

Hey, Yes I was able to follow that I need to use parsers but I am not able to figure out what exactly should I use to parse my text log files ( .txt) If you could help that would be great like I tried using - just wanted to combine 3500 lines together but this is not working please let me know what I can change here to make this work..thanks

```auto

filebeat.inputs:
- type: filestream
enabled: true
paths:
- /.pss_filecore/2022/*/*/*/*.txt
parsers:
- multiline:
    type: counter
    lines_count: 3500
output.logstash:
hosts: ["10.10.10.113:5044"]

```

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [June 12, 2022, 6:00pm UTC](https://discuss.elastic.co/t/multiline-pattern-not-working-in-filebeat-input-type-filestream/306947/4 "2022-06-12T18:00:40Z")

</div>

Think it's  
`count_lines`  
Not  
`lines_count`

Per [docs](https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html)

---

<div class="post-metadata">

**Author:** ![garry12](https://avatars.discourse-cdn.com/v4/letter/g/ac8455/32.png) [@garry12](https://discuss.elastic.co/u/garry12)\
**Post date:** [June 12, 2022, 7:55pm UTC](https://discuss.elastic.co/t/multiline-pattern-not-working-in-filebeat-input-type-filestream/306947/5 "2022-06-12T19:55:02Z")

</div>

well its not working with either of those lines\_count and count\_lines but other confusion I have is the multiline format described in this [article](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-filestream.html#_parsers) is is like -

```auto
parsers:
- multiline:
    type: counter
    lines_count: 3500

```

and in this [articles](https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html) its like this -

```auto
multiline.type: pattern
multiline.pattern: '^[[:space:]]'
multiline.negate: false
multiline.match: after

```

so which one I should use or why they are different if both achieve the same goal ?

---

<div class="post-metadata">

**Author:** ![garry12](https://avatars.discourse-cdn.com/v4/letter/g/ac8455/32.png) [@garry12](https://discuss.elastic.co/u/garry12)\
**Post date:** [June 12, 2022, 8:53pm UTC](https://discuss.elastic.co/t/multiline-pattern-not-working-in-filebeat-input-type-filestream/306947/6 "2022-06-12T20:53:28Z")

</div>

Hey, good news I got it working after few experiments one of which worked is basically combining the two snippets I posted - So in short I ended up writing parser but properties to match my use case for multiline

```auto
filebeat.inputs:

- type: filestream
  enabled: true
  id: id1
  paths:
    - /.pss_filecore/2022/06/*/*/*.txt

  parsers:
  - multiline:
       pattern: '^[[0-9]{4}-[0-9]{2}-[0-9]{2}-[0-9]{2}-[0-9]{2}-[0-9]{2}'
       negate: true
       match: after
       max_lines: 3500
output.logstash:
  hosts: ["10.10.10.140:5044"]

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 10, 2022, 8:54pm UTC](https://discuss.elastic.co/t/multiline-pattern-not-working-in-filebeat-input-type-filestream/306947/7 "2022-07-10T20:54:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.