# Multiline with Ingest Node **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [October 19, 2017, 3:45pm UTC](https://discuss.elastic.co/t/multiline-with-ingest-node/104582 "2017-10-19T15:45:24Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Fei\_Yao](https://avatars.discourse-cdn.com/v4/letter/f/85e7bf/32.png) [@Fei\_Yao](https://discuss.elastic.co/u/Fei_Yao)\ **Post date:** [October 19, 2017, 3:45pm UTC](https://discuss.elastic.co/t/multiline-with-ingest-node/104582/1 "2017-10-19T15:45:24Z")
I have the following log from Spring Boot, just for the demonstration purpose. //log starts 2017-10-19 11:21:20.949 ERROR 29648 --- [http-nio-8080-exec-5] com.example.demo.GlobalExceptionHandler : Unhandled exception occurred java.lang.IllegalArgumentException: The name params missing, sorry. at com.example.demo.HiController.greeting(HiController.java:30) ~[classes!/:0.0.1-SNAPSHOT] at sun.reflect.GeneratedMethodAccessor50.invoke(Unknown Source) ~[na:na] at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[na:1.8.0\_144] at java.lang.reflect.Method.invoke(Method.java:498) ~[na:1.8.0\_144] //log ends According to [https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html](https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html). I've set up the following config in filebeat.yml //config start multiline.pattern: '^[[:space:]]' multiline.negate: false multiline.match: after //config end It will work fine if I just dump it into Elasticsearch as a message. What if I'm using Ingest Pipeline? The problem surfaces since the event doesn't match the grok pattern (SpringBoot Logging pattern). My guess is multiline is working from the filebeat's perspective, but when the event arrives Ingest Pipeline it failed there since it just have the message body and missing TIMESTAMP\_ISO8601, etc. //In Elasticsearch, I've setup the following pipeline PUT \_ingest/pipeline/springboot\_v1 { "description": "springboot-v1", "processors": [ { "grok": { "field": "message", "patterns": ["%{TIMESTAMP\_ISO8601:logtime}%{SPACE}%{LOGLEVEL:loglevel}%{SPACE}%{NUMBER:pid}%{SPACE}---%{SPACE}%{THREAD:thread}%{SPACE}%{LOGGERNAME:loggername}%{SPACE}:%{SPACE}%{GREEDYDATA:logmessage}"], "pattern\_definitions": { "THREAD" : "\[([A-Za-z0-9-]| )+\]", "LOGGERNAME" : "\S+" } } } ] } So, I'm look for a solution. Please advice! Thanks ---
**Author:** ![Fei\_Yao](https://avatars.discourse-cdn.com/v4/letter/f/85e7bf/32.png) [@Fei\_Yao](https://discuss.elastic.co/u/Fei_Yao)\ **Post date:** [October 19, 2017, 5:15pm UTC](https://discuss.elastic.co/t/multiline-with-ingest-node/104582/2 "2017-10-19T17:15:50Z")
@spinscale I noticed that you have a comment in other thread at [Ingest Node, Multiline, Glassfish Logs](https://discuss.elastic.co/t/ingest-node-multiline-glassfish-logs/70086) Would you please take a look of mine? Which is a very similar situation. Thanks ---
**Author:** ![Fei\_Yao](https://avatars.discourse-cdn.com/v4/letter/f/85e7bf/32.png) [@Fei\_Yao](https://discuss.elastic.co/u/Fei_Yao)\ **Post date:** [October 20, 2017, 2:09am UTC](https://discuss.elastic.co/t/multiline-with-ingest-node/104582/3 "2017-10-20T02:09:08Z")
For my log example: //log starts 2017-10-19 11:21:20.949 ERROR 29648 --- [http-nio-8080-exec-5] com.example.demo.GlobalExceptionHandler : Unhandled exception occurred java.lang.IllegalArgumentException: The name params missing, sorry. at com.example.demo.HiController.greeting(HiController.java:30) ~[classes!/:0.0.1-SNAPSHOT] at sun.reflect.GeneratedMethodAccessor50.invoke(Unknown Source) ~[na:na] at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[na:1.8.0\_144] at java.lang.reflect.Method.invoke(Method.java:498) ~[na:1.8.0\_144] //log ends This one log event seems to be broken into 2 events, Event1: 2017-10-19 11:21:20.949 ERROR 29648 --- [http-nio-8080-exec-5] com.example.demo.GlobalExceptionHandler : Unhandled exception occurred Event2: java.lang.IllegalArgumentException: The name params missing, sorry. at com.example.demo.HiController.greeting(HiController.java:30) ~[classes!/:0.0.1-SNAPSHOT] at sun.reflect.GeneratedMethodAccessor50.invoke(Unknown Source) ~[na:na] at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[na:1.8.0\_144] at java.lang.reflect.Method.invoke(Method.java:498) ~[na:1.8.0\_144] Since Event1 matches the pipeline Grok pattern it will work, where the Event2 doesn't match with the pattern and it will fail. To make the matter worse, the Filebeat's output.elasticsearch will stall as well because this event cannot be pushed through. Any thoughts? ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [October 23, 2017, 12:42pm UTC](https://discuss.elastic.co/t/multiline-with-ingest-node/104582/4 "2017-10-23T12:42:30Z")
Please use the `` button for logs and configuration files in order to preserve indentation and not triggering other test formatting by accident. When working with multiline it's helpful to see the actual structure, not just the text. ---
**Author:** ![Fei\_Yao](https://avatars.discourse-cdn.com/v4/letter/f/85e7bf/32.png) [@Fei\_Yao](https://discuss.elastic.co/u/Fei_Yao)\ **Post date:** [October 23, 2017, 2:31pm UTC](https://discuss.elastic.co/t/multiline-with-ingest-node/104582/5 "2017-10-23T14:31:08Z")
Steffen, Here is the log that Im interested about: ``` 2017-10-19 10:13:52.272 ERROR 29678 --- [http-nio-8081-exec-2] com.example.demo.GlobalExceptionHandler : Unhandled exception occurred java.lang.IllegalArgumentException: The name params cannot be empty. at com.example.demo.HiController.greeting(HiController.java:30) ~[classes!/:0.0.1-SNAPSHOT] at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[na:1.8.0_144] at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[na:1.8.0_144] at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[na:1.8.0_144] at java.lang.reflect.Method.invoke(Method.java:498) ~[na:1.8.0_144] ``` Thanks ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [October 23, 2017, 2:49pm UTC](https://discuss.elastic.co/t/multiline-with-ingest-node/104582/6 "2017-10-23T14:49:44Z")
If all events start with a timestamp, apply the multiline pattern to the timestamp and use `negate: true`. I think I've shown the pattern to use in another duplicate topic of yours. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 20, 2017, 2:49pm UTC](https://discuss.elastic.co/t/multiline-with-ingest-node/104582/7 "2017-11-20T14:49:45Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.