# Multiline problem - need help

**URL:** <https://discuss.elastic.co/t/multiline-problem-need-help/200851>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [September 24, 2019, 11:20am UTC](https://discuss.elastic.co/t/multiline-problem-need-help/200851 "2019-09-24T11:20:05Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![mkaruza](https://avatars.discourse-cdn.com/v4/letter/m/ccd318/32.png) [@mkaruza](https://discuss.elastic.co/u/mkaruza)\
**Post date:** [September 24, 2019, 11:20am UTC](https://discuss.elastic.co/t/multiline-problem-need-help/200851/1 "2019-09-24T11:20:06Z")

</div>

I'm trying to assign entries without timestamp to the previous ones that DO have timestamps, so they stick together when I perform search in Elasticsearch.

However, I haven't been successful at it.

This is my filebeat config:

multiline.pattern: '^\[0-9]{4}-[0-9]{2}-[0-9]{2}'  
multiline.negate: true  
multiline.match: after

and this is the log example I'm trying to perform this on:

> 2019-05-11 12:28:23,199 [24] ERROR TcpCommunication - StartControllerTcpServerAsync\*\*  
> System.ObjectDisposedException: Cannot access a disposed object.\*\*  
> Object name: 'System.Net.Sockets.Socket'.\*\*  
> at System.Net.Sockets.Socket.EndAccept(IAsyncResult asyncResult)\*\*  
> at System.Net.Sockets.TcpListener.EndAcceptTcpClient(IAsyncResult asyncResult)\*\*  
> at System.Threading.Tasks.TaskFactory1.FromAsyncCoreLogic(IAsyncResult iar, Func`2 endFunction, Action1 endAction, Task1 promise, Boolean requiresSynchronization)\*\*  
> --- End of stack trace from previous location where exception was thrown ---\*\*  
> at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\*\*  
> at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\*\*  
> at Docs4ECMApiCommon.Utils.TcpCommunication.d\_\_20.MoveNext() in C:\ITS-GIT\ITS - IT Sistemi\ITSistemi.Docs4ECM.Api\Docs4ECMApiCommon\Utils\TcpCommunication.cs:line 127\*\*  
> 2019-05-11 12:28:23,199 [24] ERROR TcpCommunication - StartGuiTcpServerAsync\*\*

What am I doing wrong?

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 22, 2019, 11:20am UTC](https://discuss.elastic.co/t/multiline-problem-need-help/200851/2 "2019-10-22T11:20:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.