# .net logs from filebeat to logstash multiline proper format

**URL:** <https://discuss.elastic.co/t/net-logs-from-filebeat-to-logstash-multiline-proper-format/237757>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [June 19, 2020, 7:55am UTC](https://discuss.elastic.co/t/net-logs-from-filebeat-to-logstash-multiline-proper-format/237757 "2020-06-19T07:55:24Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![catadetest](https://avatars.discourse-cdn.com/v4/letter/c/a5b964/32.png) [@catadetest](https://discuss.elastic.co/u/catadetest)\
**Post date:** [June 19, 2020, 7:55am UTC](https://discuss.elastic.co/t/net-logs-from-filebeat-to-logstash-multiline-proper-format/237757/1 "2020-06-19T07:55:24Z")

</div>

I'm trying to ingest logs from a .net application. I have filebeat installed on a node which pushes the logs to a logstash server.

logfile:

```auto
2020-06-19 00:00:16.421 +02:00 [Error] [Band.Account.HealthCheckService] [2HB0AJ9Q9AI2O:00000001] The operation was canceled.
System.Threading.Tasks.TaskCanceledException: The operation was canceled. ---> System.IO.IOException: Unable to read data from the transport connection: Operation canceled. ---> System.Net.Sockets.SocketException: Operation canceled
   --- End of inner exception stack trace ---
   at System.Net.Sockets.Socket.AwaitableSocketAsyncEventArgs.ThrowException(SocketError error)
   at System.Net.Sockets.Socket.AwaitableSocketAsyncEventArgs.GetResult(Int16 token)
   at System.Net.Security.SslStreamInternal
...

```

filebeat.yml config:

```
filebeat.prospectors:
- type: log
  enabled: true
  paths:
    - /var/log/log*
  multiline.pattern: '^[[:space:]]'
  multiline.negate: false
  multiline.match: after
  fields_under_root: true
  fields:
    type: Band-account-log
  fields_under_root: true
  exclude_files: ['.gz]
logging.level: info
output.logstash:
  hosts: ["elk.Band.net"]
  ssl.certificate_authorities: "/etc/pki/tls/certs/logstash-forwarder.crt"

```

It doesn't really get all the lines from log file, and the timestamp looks wrong looking in kibana. Not really sure what I need to modify.

_filebeat version 6.2.4 (amd64), libbeat 6.2.4_

---

<div class="post-metadata">

**Author:** ![catadetest](https://avatars.discourse-cdn.com/v4/letter/c/a5b964/32.png) [@catadetest](https://discuss.elastic.co/u/catadetest)\
**Post date:** [June 19, 2020, 1:14pm UTC](https://discuss.elastic.co/t/net-logs-from-filebeat-to-logstash-multiline-proper-format/237757/2 "2020-06-19T13:14:53Z")

</div>

I managed to make it work using the conf below:  
filebeat.yml:

```
filebeat.prospectors:
- type: log
  enabled: true
  paths:
    - /var/log/log*
  multiline.pattern: '([12]\d{3}-(0[1-9]|1[0-2])-(0[1-9]|[12]\d|3[01]))'
  multiline.negate: true
  multiline.match: after
  fields_under_root: true
  fields:
    type: pirelli-account-log
  fields_under_root: true
  exclude_files: ['.gz`]
logging.level: info
output.logstash:
  hosts: ["elk.server.example"]
  ssl.certificate_authorities: "/etc/pki/tls/certs/logstash-forwarder.crt"

```

Now the logs are coming in the proper format.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 17, 2020, 3:14pm UTC](https://discuss.elastic.co/t/net-logs-from-filebeat-to-logstash-multiline-proper-format/237757/3 "2020-07-17T15:14:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.