# Multiline pattern on basis of timestamp
**URL:** https://discuss.elastic.co/t/multiline-pattern-on-basis-of-timestamp/138162
**Category:** Beats
**Tags:** filebeat
**Created:** [July 2, 2018, 9:39am UTC](https://discuss.elastic.co/t/multiline-pattern-on-basis-of-timestamp/138162 "2018-07-02T09:39:37Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Suresh\_Pal](https://discuss.elastic.co/u/Suresh_Pal)
#### Post date: [July 2, 2018, 9:39am UTC](https://discuss.elastic.co/t/multiline-pattern-on-basis-of-timestamp/138162/1 "2018-07-02T09:39:37Z")
I'm trying to implement multiline pattern on the basis of timestamp.
My grok pattern in logstash are as follows:
match =\> { "message" =\> "(?m)%{TIMESTAMP\_ISO8601:timestamp}\s\*-\s\*%{LOGLEVEL\_TEST:level}\s\*-\s\*%{GREEDYDATA:restOfMsg}" }
multiline.pattern: '^[[0-9]{4}-[0-9]{2}-[0-9]{2}'
multiline.negate: true
multiline.match: after
but I'm not able to achieve the same. please help
---
### Author:  [@adrisr](https://discuss.elastic.co/u/adrisr)
#### Post date: [July 2, 2018, 1:19pm UTC](https://discuss.elastic.co/t/multiline-pattern-on-basis-of-timestamp/138162/2 "2018-07-02T13:19:32Z")
Hi,
There seems to be a mistake in your `multiline.pattern` regular expression.
```auto
multiline.pattern: '^[[0-9]{4}-[0-9]{2}-[0-9]{2}'
```
Either you escape the first square bracket ( `'^\[[0-9...`) or remove it altogether ( `'^[0-9...`)
It depends on whether your logs start with an actual bracket (`[2018-06-28...`) or not.
---
### Author:  [@Suresh\_Pal](https://discuss.elastic.co/u/Suresh_Pal)
#### Post date: [July 3, 2018, 6:44am UTC](https://discuss.elastic.co/t/multiline-pattern-on-basis-of-timestamp/138162/3 "2018-07-03T06:44:37Z")
my date start without bracket
2018-07-03 02:44:08,541 CustomLogWrapper.java 51 [http-nio-8080-exec-2862] ERROR - Tenant Name : Default There is some Runtime Exception for the user number 1.
Exception Message: null
---
### Author:  [@Suresh\_Pal](https://discuss.elastic.co/u/Suresh_Pal)
#### Post date: [July 3, 2018, 6:54am UTC](https://discuss.elastic.co/t/multiline-pattern-on-basis-of-timestamp/138162/4 "2018-07-03T06:54:44Z")
i want separate the logs in the basis 2018-07-03 02:44:08,541. Please look into attached screenshot. i'm getting multiple stamp within same stamp.
---
### Author:  [@adrisr](https://discuss.elastic.co/u/adrisr)
#### Post date: [July 3, 2018, 8:14am UTC](https://discuss.elastic.co/t/multiline-pattern-on-basis-of-timestamp/138162/5 "2018-07-03T08:14:45Z")
So, what you want is:
- Every line that starts with a date is a new log.
- Every line that doesn't start with a date belongs to the previous line with a date.
The configuration for this is:
```auto
multiline.pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}'
multiline.negate: true
multiline.match: after
```
Have a look at the documentation for this and other examples.
[https://www.elastic.co/guide/en/beats/filebeat/current/\_examples\_of\_multiline\_configuration.html](https://www.elastic.co/guide/en/beats/filebeat/current/_examples_of_multiline_configuration.html)
---
### Author:  [@Suresh\_Pal](https://discuss.elastic.co/u/Suresh_Pal)
#### Post date: [July 3, 2018, 8:47am UTC](https://discuss.elastic.co/t/multiline-pattern-on-basis-of-timestamp/138162/6 "2018-07-03T08:47:11Z")
Thanks man, its working now. 🙂
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 31, 2018, 8:47am UTC](https://discuss.elastic.co/t/multiline-pattern-on-basis-of-timestamp/138162/7 "2018-07-31T08:47:23Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.