# Multiline usage

**URL:** <https://discuss.elastic.co/t/multiline-usage/297991>\
**Category:** Beats\
**Tags:** beats-module, filebeat\
**Created:** [February 23, 2022, 9:29am UTC](https://discuss.elastic.co/t/multiline-usage/297991 "2022-02-23T09:29:03Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Panplumousse](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/panplumousse/32/102201_2.png) [@Panplumousse](https://discuss.elastic.co/u/Panplumousse)\
**Post date:** [February 23, 2022, 9:29am UTC](https://discuss.elastic.co/t/multiline-usage/297991/1 "2022-02-23T09:29:03Z")

</div>

Hello,  
I'm new here so first off, hello everyone.  
Here is my problem.

I am using filebeat multiline with java logs  
Here is my config

```
           config:
             - type: container
               paths:
                 - /var/log/containers/*${data.kubernetes.container.id}.log
               fields:
                 type: kube-logs
               fields_under_root: true
               multiline:
                 pattern: '^[[:space:]]+(at|\.{3})[[:space:]]+\b|^java|^Caused by:'
                 negate: false
                 match: after

```

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/6/c691efb2a23c25c006b6043e21ca9ac9b8b49f25.png)

but when I check in kibana I find that I retrieve the logs correctly compile but also all the lines separated

---

<div class="post-metadata">

**Author:** ![TiagoQueiroz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tiagoqueiroz/32/107061_2.png) [@TiagoQueiroz](https://discuss.elastic.co/u/TiagoQueiroz)\
**Post date:** [February 24, 2022, 5:34pm UTC](https://discuss.elastic.co/t/multiline-usage/297991/2 "2022-02-24T17:34:36Z")

</div>

Hi @Panplumousse welcome!

Are you running Filebeat standalone or under Elastic-Agent? It seems you're using autodiscover with kubernetes provider, is that correct?

Are those duplicated entries from the same log file? Could you check the `log.file.path` on Kibana?

Could you share your whole input configuration?

---

<div class="post-metadata">

**Author:** ![Panplumousse](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/panplumousse/32/102201_2.png) [@Panplumousse](https://discuss.elastic.co/u/Panplumousse)\
**Post date:** [February 25, 2022, 9:28am UTC](https://discuss.elastic.co/t/multiline-usage/297991/3 "2022-02-25T09:28:58Z")

</div>

Hello, @TiagoQueiroz  
at first thx to answered.

I use filebeat \> logstash \> elk \< kibana in kubernetes cluster.  
Yes i use autodiscover kubernetes provider

* * *

```
   filebeat.autodiscover:
     providers:
     - type: kubernetes
       node: ${NODE_NAME}
       hints.enabled: true
       labels.dedot: true
       annotations.dedot: true
       hints.default_config:
         type: container
         paths:
           - /var/log/containers/*${data.kubernetes.container.id}.log
         fields:
           type: kube-logs
         fields_under_root: true
         multiline:
           pattern: '^.{0,10}[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[1-2][0-9]|3[0-1]).*'
           negate: true
           match: after
       templates:
         - condition.or:
              - contains.kubernetes.container.name: "container-test"
              - contains.kubernetes.container.name: "container-test2"
           config:
             - type: container
               paths:
                 - /var/log/containers/*${data.kubernetes.container.id}.log
               fields:
                 type: kube-logs
               fields_under_root: true
               multiline:
                 pattern: '^[[:space:]]+(at|\.{3})[[:space:]]+\b|^java|^Caused by:'
                 negate: false
                 match: after
   filebeat.config.modules: 
     reload.enabled: true
   output.logstash:
     hosts: logstash
     timeout: 15
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 25, 2022, 11:29am UTC](https://discuss.elastic.co/t/multiline-usage/297991/4 "2022-03-25T11:29:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.