# Multiline problem with 2 "first" lines

**URL:** <https://discuss.elastic.co/t/multiline-problem-with-2-first-lines/95770>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [August 3, 2017, 7:55pm UTC](https://discuss.elastic.co/t/multiline-problem-with-2-first-lines/95770 "2017-08-03T19:55:38Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Redempter](https://avatars.discourse-cdn.com/v4/letter/r/b487fb/32.png) [@Redempter](https://discuss.elastic.co/u/Redempter)\
**Post date:** [August 3, 2017, 7:55pm UTC](https://discuss.elastic.co/t/multiline-problem-with-2-first-lines/95770/1 "2017-08-03T19:55:38Z")

</div>

I just implemented a new ELK server to centralise all our servers' logs so I'm still pretty new to the configuration and I'm having quite a puzzling problem.

I am trying to get multilines log to be caught as one event and it works pretty well for most of them but some of them are tricky and have two "first" lines and what happen is that one event is sent for the first "first" line and then a second event is sent for the second "first" line and the rest of the multilines log.

I'm trying to find the right pattern to caught all of it in one event but I can't figure it out so I turn myself to you for help.

Here is an example of log we have:

```
[Aug-03 01:16:11.847].[ERROR] [http-nio-8443-exec-94-180] exceptions.AbstractExceptionMapper::errorResponse - Catching
javax.persistence.PersistenceException: org.hibernate.exception.ConstraintViolationException: could not execute statement
    at org.hibernate.jpa.spi.AbstractEntityManagerImpl.convert(AbstractEntityManagerImpl.java:1763) ~[hibernate-entitymanager-4.3.11.Final.jar:4.3.11.Final]          
    at org.hibernate.jpa.spi.AbstractEntityManagerImpl.convert(AbstractEntityManagerImpl.java:1677) ~[hibernate-entitymanager-4.3.11.Final.jar:4.3.11.Final          
    at org.hibernate.jpa.spi.AbstractEntityManagerImpl.convert(AbstractEntityManagerImpl.java:1683) ~[hibernate-entitymanager-4.3.11.Final.jar:4.3.11.Final]

```

See how the `[ERROR]` tag is on one line but the rest of the log is below that second line, so when doing a search in Kibana for `ERROR`, it's not working. So what I'm trying to do is to send all of this as one event. Also the second line can change, it's not always the same message.

My current multiline pattern is as follow

```
multiline.pattern: '^\t|^[[:space:]]+(at|...)|^Caused by:'
multiline.negate: false
multiline.match: after

```

Is there a pattern for what I'm looking for?

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [August 3, 2017, 8:16pm UTC](https://discuss.elastic.co/t/multiline-problem-with-2-first-lines/95770/2 "2017-08-03T20:16:38Z")

</div>

How about using the timestamp at the pattern? [https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html#\_timestamps](https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html#_timestamps)

---

<div class="post-metadata">

**Author:** ![Redempter](https://avatars.discourse-cdn.com/v4/letter/r/b487fb/32.png) [@Redempter](https://discuss.elastic.co/u/Redempter)\
**Post date:** [August 3, 2017, 8:26pm UTC](https://discuss.elastic.co/t/multiline-problem-with-2-first-lines/95770/3 "2017-08-03T20:26:59Z")

</div>

And change the negate to true to catch all the lines after it? As I said, still pretty new to this so I don't understand all the configurations yet. I'm trying things in a sort of regex playground, it seems to work.

I'll give it a try and see what are the results.

Thanks!

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [August 3, 2017, 8:29pm UTC](https://discuss.elastic.co/t/multiline-problem-with-2-first-lines/95770/4 "2017-08-03T20:29:05Z")

</div>

> [@Redempter](#):
>
> And change the negate to true to catch all the lines after it?

Yep, just like the example shows, but customize the date pattern.

---

<div class="post-metadata">

**Author:** ![Redempter](https://avatars.discourse-cdn.com/v4/letter/r/b487fb/32.png) [@Redempter](https://discuss.elastic.co/u/Redempter)\
**Post date:** [August 4, 2017, 3:10pm UTC](https://discuss.elastic.co/t/multiline-problem-with-2-first-lines/95770/5 "2017-08-04T15:10:20Z")

</div>

It worked perfectly!

Thanks a lot!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 1, 2017, 3:10pm UTC](https://discuss.elastic.co/t/multiline-problem-with-2-first-lines/95770/6 "2017-09-01T15:10:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.