# Multiline pattern setting for multiple loglines in XML file

**URL:** <https://discuss.elastic.co/t/multiline-pattern-setting-for-multiple-loglines-in-xml-file/183618>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 30, 2019, 9:56pm UTC](https://discuss.elastic.co/t/multiline-pattern-setting-for-multiple-loglines-in-xml-file/183618 "2019-05-30T21:56:15Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![kishorerv93](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kishorerv93/32/47194_2.png) [@kishorerv93](https://discuss.elastic.co/u/kishorerv93)\
**Post date:** [May 31, 2019, 2:56pm UTC](https://discuss.elastic.co/t/multiline-pattern-setting-for-multiple-loglines-in-xml-file/183618/2 "2019-05-31T14:56:02Z")

</div>

````auto
```multiline.pattern: '^<Entry|^=[a-z]'
    multiline.negate : false
    multiline.match: after```

My logstash.conf
input{
 beats {
     port => 5044
}

}
filter{
  xml{
      source => message
      store_xml => true
      target => "doc"
      xpath => ["/Eventlog[@name='ThreadId']@value", "ThreadId",
                        "/Eventlog[@name='Thread']@value", "Thread",
                        "/Eventlog[@name='Secs']@value", "Seconds",
                        "/Eventlog/Entry/text()", "details"
                        ]
}

  Now my question is, I was able get every line in the above xml in a each message, but i'm unable to get all the log lines in a single message.

Anyone can assist ?

Thanks

````

Reply

### This topic will close a month after the last reply.

Bookmark Share Flag Reply

Watching

You will receive notifications because you created this topic.

### Suggested Topics

| Topic | Replies | Views | Activity |
| --- | --- | --- | --- |
| [Unable to start elasticsearch after creating cert for http communication](https://discuss.elastic.co/t/unable-to-start-elasticsearch-after-creating-cert-for-http-communication/175037/14) [3](https://discuss.elastic.co/t/unable-to-start-elasticsearch-after-creating-cert-for-http-communication/175037/14) | | | |

[Elasticsearch](https://discuss.elastic.co/c/elasticsearch)

[stack-security](https://discuss.elastic.co/tags/stack-security)|[15](https://discuss.elastic.co/t/multiline-pattern-setting-for-multiple-loglines-in-xml-file/183618)|159|[Apr 5](https://discuss.elastic.co/t/unable-to-start-elasticsearch-after-creating-cert-for-http-communication/175037/16)|  
|[How to remove agent.\* and ecs.version?](https://discuss.elastic.co/t/how-to-remove-agent-and-ecs-version/183643)

[Filebeat](https://discuss.elastic.co/c/beats/filebeat)|[3](https://discuss.elastic.co/t/multiline-pattern-setting-for-multiple-loglines-in-xml-file/183618)|19|[1h](https://discuss.elastic.co/t/how-to-remove-agent-and-ecs-version/183643/4)|  
|[Help needed for setup.template.append\_fields usage](https://discuss.elastic.co/t/help-needed-for-setup-template-append-fields-usage/183701)

[Filebeat](https://discuss.elastic.co/c/beats/filebeat)|[0](https://discuss.elastic.co/t/multiline-pattern-setting-for-multiple-loglines-in-xml-file/183618)|7|[5h](https://discuss.elastic.co/t/help-needed-for-setup-template-append-fields-usage/183701/1)|  
|[Multiline JSON not importing to fields in ElasticSearch - do I need Logstash?](https://discuss.elastic.co/t/multiline-json-not-importing-to-fields-in-elasticsearch-do-i-need-logstash/183695)

[Filebeat](https://discuss.elastic.co/c/beats/filebeat)|[0](https://discuss.elastic.co/t/multiline-pattern-setting-for-multiple-loglines-in-xml-file/183618)|11|[5h](https://discuss.elastic.co/t/multiline-json-not-importing-to-fields-in-elasticsearch-do-i-need-logstash/183695/1)|  
|[【filebeat output.file】when the output filebeat has been deleted，it wont be created agian automatically](https://discuss.elastic.co/t/filebeat-output-file-when-the-output-filebeat-has-been-deleted-it-wont-be-created-agian-automatically/183675)

[Filebeat](https://discuss.elastic.co/c/beats/filebeat)|[0](https://discuss.elastic.co/t/multiline-pattern-setting-for-multiple-loglines-in-xml-file/183618)|8|[7h](https://discuss.elastic.co/t/filebeat-output-file-when-the-output-filebeat-has-been-deleted-it-wont-be-created-agian-automatically/183675/1)|

### There are [2 unread](https://discuss.elastic.co/unread) and [211 new](https://discuss.elastic.co/new) topics remaining, or browse other topics in [Filebeat](https://discuss.elastic.co/c/beats/filebeat)

© 2018. All Rights Reserved - Elasticsearch

- Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
- [Trademarks](https://www.elastic.co/legal/trademarks)
- [Terms](https://www.elastic.co/legal/terms-of-use)
- [Privacy](https://www.elastic.co/legal/privacy-policy)
- [Brand](https://www.elastic.co/brand)
- [Code of Conduct](https://www.elastic.co/community/codeofconduct)

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the [Apache Software Foundation](http://www.apache.org/) in the United States and/or other countries.

---

_[View the full topic](https://discuss.elastic.co/t/multiline-pattern-setting-for-multiple-loglines-in-xml-file/183618)._