# Multipleline pattern not working

**URL:** <https://discuss.elastic.co/t/multipleline-pattern-not-working/174451>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 29, 2019, 1:46am UTC](https://discuss.elastic.co/t/multipleline-pattern-not-working/174451 "2019-03-29T01:46:59Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![yagami23](https://avatars.discourse-cdn.com/v4/letter/y/e19adc/32.png) [@yagami23](https://discuss.elastic.co/u/yagami23)\
**Post date:** [March 29, 2019, 1:46am UTC](https://discuss.elastic.co/t/multipleline-pattern-not-working/174451/1 "2019-03-29T01:46:59Z")

</div>

Hi, i would like to separate the log below in to 2 event , but the multiple line pattern fails to do that, any help appreciated

[2019-03-28T20:16:55.092-05:00] [soa\_server2] [NOTIFICATION] [oracle.integration.platform.blocks.soap] [tid: [ACTIVE].ExecuteThread: '58' for queue: 'weblogic.kernel.Default (self-tuning)'] [userId: \<anonymous\>] [ecid: febf7231-0951-4764-bb80-10c2a15ff1f2-00cd1871,1:279692] [APP: soa-infra] [oracle.soa.tracking.FlowId: 37703369] [oracle.soa.tracking.InstanceId: 221175315] [oracle.soa.tracking.SCAEntityId: 170048] [composite\_name: Async\_Invoke\_Import\_Model!1.7] [FlowId: 0000Mb71McV2VO8TNiQ5Se1SZWCT000qY9] Comparing endpoint port 8001 against system enabled HTTP/HTTPS port..  
[2019-03-28T20:16:55.092-05:00] [soa\_server2] [NOTIFICATION] [oracle.integration.platform.blocks] [tid: [ACTIVE].ExecuteThread: '58' for queue: 'weblogic.kernel.Default (self-tuning)'] [userId: \<anonymous\>] [ecid: febf7231-0951-4764-bb80-10c2a15ff1f2-00cd1871,1:279692] [APP: soa-infra] [oracle.soa.tracking.FlowId: 37703369] [oracle.soa.tracking.InstanceId: 221175315] [oracle.soa.tracking.SCAEntityId: 170048] [composite\_name: Async\_Invoke\_Import\_Model!1.7] [FlowId: 0000Mb71McV2VO8TNiQ5Se1SZWCT000qY9] HTTPS server URL retrieved from platform provider is null

This is my pattern setting, for date format in the log [2019-03-28T20:16:55.092-05:00] :

multiline.pattern: '^['  
multiline.negate: true  
multiline.match: after

i tried with the patterns below also not working:  
^[  
^[d{4}-  
^[[0-9]{4}-[0-9]{2}-[[:alpha:]]{5}:[0-9]{2}:[0-9]{2}.[0-9]{3}-[0-9]{2}:[0-9]{2}]  
^[[0-9]{4}-[0-9]{2}-[0-9A-Za-z]{5}:[0-9]{2}:[0-9]{2}.[0-9]{3}-[0-9]{2}:[0-9]{2}]

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [March 29, 2019, 11:33am UTC](https://discuss.elastic.co/t/multipleline-pattern-not-working/174451/2 "2019-03-29T11:33:51Z")

</div>

The patterns you have shared, should be working. Could you please share your full configuration and format it using `</>`?

---

<div class="post-metadata">

**Author:** ![yagami23](https://avatars.discourse-cdn.com/v4/letter/y/e19adc/32.png) [@yagami23](https://discuss.elastic.co/u/yagami23)\
**Post date:** [April 1, 2019, 12:59am UTC](https://discuss.elastic.co/t/multipleline-pattern-not-working/174451/3 "2019-04-01T00:59:18Z")

</div>

i using Filebeat 6.5.4, below is my filebeat content:

=============================  
filebeat.inputs:  
-type: log  
enabled: true  
paths:  
-/opt/apps/weblogic/soa\_prod\_server/user\_projects/domains/soa\_prod\_domain/servers/bam\_server2/logs/bam\_server2-diagnostic.log

multiline.pattern: '^[[0-9]{4}-[0-9]{2}-[[:alpha:]]{5}:[0-9]{2}:[0-9]{2}.[0-9]{3}-[0-9]{2}:[0-9]{2}]'  
multiline.negate: true  
multiline.match: after  
exclude\_files: ['.gz$', '.zip$', '.tar$' , '.tgz$' , '.lck$', 'bz2$']  
fields:  
env: prod  
tail\_files: true  
tags: ["websys","weblogic"]

setup.kibana:

output.logstash:  
hosts: ["abc1:5044","def2:5044","ghi3:5044"]  
loadbalance: true

logging.level: info  
logging.to\_files: true  
logging.files:  
path: /opt/apps/filebeat/logs  
name: filebeat-logs  
keepfiles: 7

processors:

- add\_host\_metadata: ~
- add\_cloud\_metadata: ~

---

<div class="post-metadata">

**Author:** ![yagami23](https://avatars.discourse-cdn.com/v4/letter/y/e19adc/32.png) [@yagami23](https://discuss.elastic.co/u/yagami23)\
**Post date:** [April 2, 2019, 12:26am UTC](https://discuss.elastic.co/t/multipleline-pattern-not-working/174451/4 "2019-04-02T00:26:19Z")

</div>

issue resolve by add in "+"

^\ [+[0-9]{4}-[0-9]{2}-[[:alpha:]]{5}:[0-9]{2}:[0-9]{2}.[0-9]{3}-[0-9]{2}:[0-9]{2}]

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 30, 2019, 12:26am UTC](https://discuss.elastic.co/t/multipleline-pattern-not-working/174451/5 "2019-04-30T00:26:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.