# Multiline with type filestram

**URL:** <https://discuss.elastic.co/t/multiline-with-type-filestram/304695>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 13, 2022, 3:02pm UTC](https://discuss.elastic.co/t/multiline-with-type-filestram/304695 "2022-05-13T15:02:44Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![adrianfusco](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrianfusco/32/111798_2.png) [@adrianfusco](https://discuss.elastic.co/u/adrianfusco)\
**Post date:** [May 13, 2022, 3:02pm UTC](https://discuss.elastic.co/t/multiline-with-type-filestram/304695/1 "2022-05-13T15:02:44Z")

</div>

Hello,

I see `type:log` is going to be deprecated ([Log input | Filebeat Reference [8.2] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-log.html)) and we should use `filestream` instead of this one.

I'm trying to parse some output from ansible. A very simple basic example:

```auto
TASK [example task] ********************************************
this is the first line of multilinetask that should bet added to the TASK message too
META: example meta

```

I have tried different configurations, but I see this one should work (read the following link) but it doesn't seem to work for me:

- [Multi-line Filebeat templates don't work with filebeat.inputs - type: filestream](https://discuss.elastic.co/t/multi-line-filebeat-templates-dont-work-with-filebeat-inputs-type-filestream/274510)

Example of `filebeat.yml` conf:

```auto
filebeat.inputs:
- type: filestream
  paths:
    - /home/afuscoar/task.log
  parsers:
  - multiline:
      type: pattern
      pattern: '(PLAY|META)'
      negate: true
      match: after
  fields_under_root: true

```

```auto
       "message" => "TASK [example task] ********************************************",
...
       "message" => "this is the first line of multilinetask that should bet added to the TASK message too",
...
       "message" => "META: example meta",

```

Instead of something like this:

```auto
       "message" => "TASK [example task] ******************************************** \nthis is the first line of multilinetask that should bet added to the TASK message too",
...
       "message" => "META: example meta",

```

Does anyone know what could be the problem? It was working perfectly using `type: log` and `multiline.*`.

I tried different indentations in the `multiline` section.

Thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 10, 2022, 5:03pm UTC](https://discuss.elastic.co/t/multiline-with-type-filestram/304695/2 "2022-06-10T17:03:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.