# Multiple files with different Multilnes

**URL:** <https://discuss.elastic.co/t/multiple-files-with-different-multilnes/137132>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [June 24, 2018, 4:14am UTC](https://discuss.elastic.co/t/multiple-files-with-different-multilnes/137132 "2018-06-24T04:14:35Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![astrovj](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/astrovj/32/81914_2.png) [@astrovj](https://discuss.elastic.co/u/astrovj)\
**Post date:** [June 24, 2018, 4:14am UTC](https://discuss.elastic.co/t/multiple-files-with-different-multilnes/137132/1 "2018-06-24T04:14:36Z")

</div>

I am attempting to read 2 files with multiline logs. But I am not getting the desired result.  
In test1.log line starts with date.  
In test2.log line starts with time.  
I get results for each log individually but when I combine them I don't get correct results.

* * *

filebeat.prospectors:

- type: log  
enabled: true  
paths:

- type: log  
enabled: true  
paths:

---

<div class="post-metadata">

**Author:** ![astrovj](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/astrovj/32/81914_2.png) [@astrovj](https://discuss.elastic.co/u/astrovj)\
**Post date:** [June 24, 2018, 4:30am UTC](https://discuss.elastic.co/t/multiple-files-with-different-multilnes/137132/2 "2018-06-24T04:30:20Z")

</div>

Actually the yml above is working.  
But when I use multiple multiline patterns using "or" like this, it gives result only for test2.log.

* * *

filebeat.prospectors:

- type: log  
enabled: true  
paths:

- type: log  
enabled: true  
paths:

---

<div class="post-metadata">

**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\
**Post date:** [June 25, 2018, 9:42pm UTC](https://discuss.elastic.co/t/multiple-files-with-different-multilnes/137132/3 "2018-06-25T21:42:00Z")

</div>

Hi @astrovj and welcome 🙂

When posting commands or configuration you can use the `</>` button to monospace it so it is easier to read.

Regarding your configuration, if they are exactly the ones you are using, I think that the quote before the `|` (the "or") should be removed.

---

<div class="post-metadata">

**Author:** ![astrovj](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/astrovj/32/81914_2.png) [@astrovj](https://discuss.elastic.co/u/astrovj)\
**Post date:** [July 11, 2018, 10:13am UTC](https://discuss.elastic.co/t/multiple-files-with-different-multilnes/137132/4 "2018-07-11T10:13:01Z")

</div>

Thanks for your reply. I missed removing that quote before the |.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 8, 2018, 10:13am UTC](https://discuss.elastic.co/t/multiple-files-with-different-multilnes/137132/5 "2018-08-08T10:13:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.