# Multline Logs via filebeat

**URL:** <https://discuss.elastic.co/t/multline-logs-via-filebeat/123706>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 13, 2018, 9:48am UTC](https://discuss.elastic.co/t/multline-logs-via-filebeat/123706 "2018-03-13T09:48:32Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![saramali](https://avatars.discourse-cdn.com/v4/letter/s/da6949/32.png) [@saramali](https://discuss.elastic.co/u/saramali)\
**Post date:** [March 13, 2018, 9:48am UTC](https://discuss.elastic.co/t/multline-logs-via-filebeat/123706/1 "2018-03-13T09:48:32Z")

</div>

I'm sending logs to a remote server via filebeat. Currently, each line of log is sent separately as a document. I want to send filebeat to send the log as one document till the loglevel of the next log is found. It is easily achievable in logstash but since filbeat only takes regex patterns. I found this regex "/(?:DEBUG|INFO|ERROR|WARN)[\s\S]+?(?=DEBUG|INFO|WARN|ERROR)/gm" but it gives me parse error.

---

<div class="post-metadata">

**Author:** ![exekias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/exekias/32/28718_2.png) [@exekias](https://discuss.elastic.co/u/exekias)\
**Post date:** [March 13, 2018, 11:19am UTC](https://discuss.elastic.co/t/multline-logs-via-filebeat/123706/2 "2018-03-13T11:19:53Z")

</div>

Hi @saramali,

We offer a way to test multiline patterns beforehand, have a look to [https://www.elastic.co/guide/en/beats/filebeat/6.2/\_test\_your\_regexp\_pattern\_for\_multiline.html](https://www.elastic.co/guide/en/beats/filebeat/6.2/_test_your_regexp_pattern_for_multiline.html)

You can iterate over your regexp pattern until you find a match

Best regards

---

<div class="post-metadata">

**Author:** ![saramali](https://avatars.discourse-cdn.com/v4/letter/s/da6949/32.png) [@saramali](https://discuss.elastic.co/u/saramali)\
**Post date:** [March 13, 2018, 11:31am UTC](https://discuss.elastic.co/t/multline-logs-via-filebeat/123706/3 "2018-03-13T11:31:59Z")

</div>

Thank you for replying.  
I'm certain this regex works. I have tested it. It is something related to perl regex.  
I seem to have escape characters in the regex string and when I use \ to escape them, the regex functionality breaks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 10, 2018, 11:32am UTC](https://discuss.elastic.co/t/multline-logs-via-filebeat/123706/4 "2018-04-10T11:32:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.