# Mutliline logs

**URL:** <https://discuss.elastic.co/t/mutliline-logs/178786>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [April 28, 2019, 7:05am UTC](https://discuss.elastic.co/t/mutliline-logs/178786 "2019-04-28T07:05:45Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ameed\_Ashour](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ameed_ashour/32/45171_2.png) [@Ameed\_Ashour](https://discuss.elastic.co/u/Ameed_Ashour)\
**Post date:** [April 28, 2019, 7:05am UTC](https://discuss.elastic.co/t/mutliline-logs/178786/1 "2019-04-28T07:05:45Z")

</div>

Hi,

I am trying to do multiline in this lines:

```
    2019-03-07 10:00:32.853 29 ERROR nova.conductor.manager Traceback (most recent call last):
2019-03-07 10:00:32.853 29 ERROR nova.conductor.manager 
2019-03-07 10:00:32.853 29 ERROR nova.conductor.manager File "/usr/lib/python2.7/site-packages/oslo_messaging/rpc/server.py", line 226, in inner
2019-03-07 10:00:32.853 29 ERROR nova.conductor.manager return func(*args, **kwargs)
2019-03-07 10:00:32.853 29 ERROR nova.conductor.manager 
2019-03-07 10:00:32.853 29 ERROR nova.conductor.manager File "/usr/lib/python2.7/site-packages/nova/scheduler/manager.py", line 154, in select_destinations
2019-03-07 10:00:32.853 29 ERROR nova.conductor.manager allocation_request_version, return_alternates)
2019-03-07 10:00:32.853 29 ERROR nova.conductor.manager 
2019-03-07 10:00:32.853 29 ERROR nova.conductor.manager File "/usr/lib/python2.7/site-packages/nova/scheduler/filter_scheduler.py", line 91, in select_destinations
2019-03-07 10:00:32.853 29 ERROR nova.conductor.manager allocation_request_version, return_alternates)
2019-03-07 10:00:32.853 29 ERROR nova.conductor.manager 
2019-03-07 10:00:32.853 29 ERROR nova.conductor.manager File "/usr/lib/python2.7/site-packages/nova/scheduler/filter_scheduler.py", line 244, in _schedule
2019-03-07 10:00:32.853 29 ERROR nova.conductor.manager claimed_instance_uuids)
2019-03-07 10:00:32.853 29 ERROR nova.conductor.manager 
2019-03-07 10:00:32.853 29 ERROR nova.conductor.manager File "/usr/lib/python2.7/site-packages/nova/scheduler/filter_scheduler.py", line 281, in _ensure_sufficient_hosts
2019-03-07 10:00:32.853 29 ERROR nova.conductor.manager raise exception.NoValidHost(reason=reason)
2019-03-07 10:00:32.853 29 ERROR nova.conductor.manager 
2019-03-07 10:00:32.853 29 ERROR nova.conductor.manager NoValidHost: No valid host was found. There are not enough hosts available.
2019-03-07 10:00:32.853 29 ERROR nova.conductor.manager 
2019-03-07 10:00:32.853 29 ERROR nova.conductor.manager 
2019-03-07 10:00:32.910 29 WARNING nova.scheduler.utils [req-7cd43fe9-c1b2-4c9c-83fc-caf21a13a18c 97347d53322b4c0f8b263820df06e2c9 87eeb0421737425c9b5e9bb0892bde36 - default default] Failed to compute_task_build_instances: No valid host was found. There are not enough hosts available.
Traceback (most recent call last):

  File "/usr/lib/python2.7/site-packages/oslo_messaging/rpc/server.py", line 226, in inner
    return func(*args, **kwargs)

  File "/usr/lib/python2.7/site-packages/nova/scheduler/manager.py", line 154, in select_destinations
    allocation_request_version, return_alternates)

  File "/usr/lib/python2.7/site-packages/nova/scheduler/filter_scheduler.py", line 91, in select_destinations
    allocation_request_version, return_alternates)

  File "/usr/lib/python2.7/site-packages/nova/scheduler/filter_scheduler.py", line 244, in _schedule
    claimed_instance_uuids)

  File "/usr/lib/python2.7/site-packages/nova/scheduler/filter_scheduler.py", line 281, in _ensure_sufficient_hosts
    raise exception.NoValidHost(reason=reason)

NoValidHost: No valid host was found. There are not enough hosts available.
: NoValidHost_Remote: No valid host was found. There are not enough hosts available.
2019-03-07 10:00:32.911 29 WARNING nova.scheduler.utils [req-7cd43fe9-c1b2-4c9c-83fc-caf21a13a18c 97347d53322b4c0f8b263820df06e2c9 87eeb0421737425c9b5e9bb0892bde36 - default default] [instance: b8d95c52-0894-4c96-9fc8-51b6d6763fd0] Setting instance to ERROR state.: NoValidHost_Remote: No valid host was found. There are not enough hosts available.

```

this is my filebeat config:

```
filebeat:
  prospectors:
    - paths:
      - /var/log/nova/*.log
      - /var/log/containers/nova/*.log
      encoding: plain
      fields:
        tag: nova
      fields_under_root: true
      input_type: log
      document_type: nova
      scan_frequency: 10s
      harvester_buffer_size: 16384
      tail_files: false
      force_close_files: false
      backoff: 1s
      max_backoff: 10s
      backoff_factor: 2
      partial_line_waiting: 5s
      max_bytes: 10485760
      multiline.pattern : "^([0-9]{4}-[0-9]{2}-[0-9]{2})"
      multiline.negate: true
      multiline.match: after

```

It works for lines which don't have a timestamp, I want to complete the pattern to get Traceback lines which include a timestamp.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 26, 2019, 7:05am UTC](https://discuss.elastic.co/t/mutliline-logs/178786/2 "2019-05-26T07:05:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.