# Multiline under multiline filebeat

**URL:** <https://discuss.elastic.co/t/multiline-under-multiline-filebeat/311904>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [August 11, 2022, 7:40am UTC](https://discuss.elastic.co/t/multiline-under-multiline-filebeat/311904 "2022-08-11T07:40:57Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![alex\_vermex](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_vermex/32/101267_2.png) [@alex\_vermex](https://discuss.elastic.co/u/alex_vermex)\
**Post date:** [August 11, 2022, 7:40am UTC](https://discuss.elastic.co/t/multiline-under-multiline-filebeat/311904/1 "2022-08-11T07:40:57Z")

</div>

Hi,  
I split each log using multiline filebeat:

```auto
- type: log
  enabled: true
  paths:
    - D:\elastic_stack\journal\*
  fields:
        kafka_topic: "kafka-topic-1"
  
  multiline.type: pattern
  multiline.pattern: '^\s*\*TR\sSTART\*\s*'
  multiline.negate: true
  multiline.match: after
  multiline.max_lines: 1000

```

So with that it gives me every `*TR START*` gives me a document, **sometimes** I found a document like this:

```auto
*TR START*                
 AAAA INS                          
AAAA: 666677777                 
DATE 20-07-22 TIME 09:21:41          
 09:21:47 PI                  
 09:21:53 AT             
 09:21:55 OP            
 09:21:55 GEN               
                                        
******************                      
DATE HEURE A                 
20/07/22 09:21 0000001          
  AAAA:77777777777                  
MO : 10.000             
TR. NO: 3998                     
                                        
  TR REFUSEE                   
 09:22:02 PI                   
 09:22:03 AT           
 09:22:05 OP          
 09:22:05 GEN                   
                                        
******************                      
DATE HEURE A                 
20/07/22 09:21 00000333          
AAAA:0000999999                  
MO : 20            
TR. NO: 3999                     
                                        
  TR REFUSEE                   
 09:22:12 PI                  
 09:22:12 AT             
 09:22:14 OP           
 09:22:15 GEN               

******************                      
DATE HEURE A                 
20/07/22 09:21 5555555         
AAAA:99944422000                  
MO : 10           
TR. NO: 4000                     
                                        
  TR REFUSEE

```

So I want to split it with multiline `TR REFUSEE` it means give me a new document, for this example so it would have to add me 3 new documents because I have 3 `TR REFUSEE`

Any help would be sincerely appreciate!  
Thanks!

---

<div class="post-metadata">

**Author:** ![alex\_vermex](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_vermex/32/101267_2.png) [@alex\_vermex](https://discuss.elastic.co/u/alex_vermex)\
**Post date:** [August 11, 2022, 8:17am UTC](https://discuss.elastic.co/t/multiline-under-multiline-filebeat/311904/2 "2022-08-11T08:17:28Z")

</div>

I mean after splitting the hole file with _TR START_ if there is TR REFUGEE in one document do the multiline with 20 lines for example.  
i tried this

```auto
- type: log
  enabled: true
  paths:
    - D:\elastic_stack\journal\*
  fields:
        kafka_topic: "kafka-topic-1"
  
  multiline.type: pattern
  multiline.pattern: '^\s*\*TR\sSTART\*\s*'
  multiline.negate: true
  multiline.match: after
  multiline.max_lines: 1000
  multiline.type: pattern
  multiline.pattern: '^\s*TR\sREFUSEE\s*'
  multiline.negate: true
  multiline.match: after
  multiline.max_lines: 20

```

but it split me the whole file with `TR REFUSED` 😕 i don't know how it works

Any help would be sincerely appreciate!  
Thanks!

---

<div class="post-metadata">

**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\
**Post date:** [August 22, 2022, 3:17pm UTC](https://discuss.elastic.co/t/multiline-under-multiline-filebeat/311904/3 "2022-08-22T15:17:06Z")

</div>

Hi,

Would it work if you configure a pattern that matches both strings that you expect to start a document?

Something like this (not tested):

```auto
  multiline.type: pattern
  multiline.pattern: '^\s*(\*TR\sSTART\*|\s*TR REFUSEE)\s*'`
  multiline.negate: true
  multiline.match: after
  multiline.max_lines: 1000

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 19, 2022, 5:18pm UTC](https://discuss.elastic.co/t/multiline-under-multiline-filebeat/311904/4 "2022-09-19T17:18:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.