# Need help on Multiline Pattern
**URL:** https://discuss.elastic.co/t/need-help-on-multiline-pattern/195857
**Category:** Beats
**Tags:** filebeat
**Created:** [August 20, 2019, 7:40am UTC](https://discuss.elastic.co/t/need-help-on-multiline-pattern/195857 "2019-08-20T07:40:34Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@lsanbu](https://discuss.elastic.co/u/lsanbu)
#### Post date: [August 20, 2019, 7:40am UTC](https://discuss.elastic.co/t/need-help-on-multiline-pattern/195857/1 "2019-08-20T07:40:34Z")
Dear Team,
Greetings. I'm new to Elastic/File beat.
I'm trying to read a log in the following pattern:
[2019-08-18 19:g19:50,787]-[NhdQWhb\_Z3arvCz4zWh3hEo:1353000:10.142.125.44]-
POST /ncs/anc/ANC2250S.do METHOD=next
Operation :SUCCESSFUL
Returning forward to :/WEB-INF/pages/anc/ListAnnouncement.jsp
[2019-08-18 19:g19:58,388]-[NhdQWhb\_Z3arvCz4zWh3hEo:1353000:10.142.125.44]-
POST /ncs/anc/ANC2250S.do METHOD=next
Operation :SUCCESSFUL
Returning forward to :/WEB-INF/pages/anc/ListAnnouncement.jsp
[2019-08-18 19:g20:04,421]-[NhdQWhb\_Z3arvCz4zWh3hEo:1353000:10.142.125.44]-
POST /ncs/anc/ANC2250S.do METHOD=next
Operation :SUCCESSFUL
Returning forward to :/WEB-INF/pages/anc/ListAnnouncement.jsp
[2019-08-18 19:g20:12,536]-[NhdQWhb\_Z3arvCz4zWh3hEo:1353000:10.142.125.44]-
POST /ncs/anc/ANC2250S.do METHOD=next
Operation :SUCCESSFUL
Returning forward to :/WEB-INF/pages/anc/ListAnnouncement.jsp
[2019-08-18 19:g20:22,331]-[NhdQWhb\_Z3arvCz4zWh3hEo:1353000:10.142.125.44]-
POST /ncs/anc/ANC2250S.do METHOD=next
Operation :SUCCESSFUL
Returning forward to :/WEB-INF/pages/anc/ListAnnouncement.jsp
Having this config in filebeat.yml, can someone help to identify guide if any issue, as every single line capturing as seperate record and not as expected as single record until the next timeline.
filebeat.inputs:
- type: log
enabled: true
paths:
- '/APP/PSS/Elastic/filebeat-7.2.1-linux-x86\_64/UserActivity.log'
- '/APP/UAT2/prd/bancs/bancshome/logs/NCSOnline.log'
- '/prd/bancs/bancshome/logs/UserActivity.log'
#============================= Filebeat modules ===============================
filebeat.config.modules:
# path: 'C:\Program Files\Filebeat\modules.d\*.yml'
path: 'I:\ELK\filebeat\filebeat-7.2.0-windows-x86\modules.d\*.yml'
reload.enabled: true
reload.period: 60s
multiline.pattern: '^[[0-9]{4}-[0-9]{2}-[0-9]{2}'
multiline.negate: false
multiline.match: after
#multiline.flush\_pattern: 'Returning forward to :'
#==================== Elasticsearch template setting ==========================
---
### Author:  [@faec](https://discuss.elastic.co/u/faec)
#### Post date: [August 22, 2019, 5:38pm UTC](https://discuss.elastic.co/t/need-help-on-multiline-pattern/195857/2 "2019-08-22T17:38:53Z")
Welcome! It looks like this log should work with a much simpler pattern. Try this configuration (copied from [this doc page](https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html)):
```auto
multiline.pattern: '^\['
multiline.negate: true
multiline.match: after
```
---
### Author:  [@lsanbu](https://discuss.elastic.co/u/lsanbu)
#### Post date: [August 29, 2019, 6:15am UTC](https://discuss.elastic.co/t/need-help-on-multiline-pattern/195857/3 "2019-08-29T06:15:32Z")
Hi Fae,
Thanks a lot for your input. Event I thought so... but with these lines you given also, the same and events not getting appended and populating as individual line entries.!?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 26, 2019, 6:15am UTC](https://discuss.elastic.co/t/need-help-on-multiline-pattern/195857/4 "2019-09-26T06:15:39Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.