# Newcomer multiline.pattern question

**URL:** https://discuss.elastic.co/t/newcomer-multiline-pattern-question/300934
**Category:** Beats
**Tags:** filebeat
**Created:** [March 29, 2022, 9:00am UTC](https://discuss.elastic.co/t/newcomer-multiline-pattern-question/300934 "2022-03-29T09:00:56Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![covfefe](https://avatars.discourse-cdn.com/v4/letter/c/ee7513/32.png) [@covfefe](https://discuss.elastic.co/u/covfefe)
#### Post date: [March 29, 2022, 9:00am UTC](https://discuss.elastic.co/t/newcomer-multiline-pattern-question/300934/1 "2022-03-29T09:00:56Z")

</div>

Hi, new to filebeat and multiline.pattern configuration as a whole.

I was reading up on multiline.pattern examples and came across this

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/7/07352a78b1734255368c9d084eb33b885cf474b8.png)  
where the example used was multiline.pattern: '\[1\]'. But lets say if each line after the initial line beginning was a symbol like { or " instead of a whitespace, how do I put it?  
multiline.pattern: '^{' or multiline.pattern: '\[2\]' or something else entirely?

Sorry if it sounds like a dumb and simple question but I am not able to find any relevant/similar queries like this.

* * *

1. [:space:] 

2. [:{:]

---

<div class="post-metadata">

### Author: ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)
#### Post date: [March 29, 2022, 12:33pm UTC](https://discuss.elastic.co/t/newcomer-multiline-pattern-question/300934/2 "2022-03-29T12:33:04Z")

</div>

You should just do `'^{'`.

---

<div class="post-metadata">

### Author: ![covfefe](https://avatars.discourse-cdn.com/v4/letter/c/ee7513/32.png) [@covfefe](https://discuss.elastic.co/u/covfefe)
#### Post date: [March 30, 2022, 2:22am UTC](https://discuss.elastic.co/t/newcomer-multiline-pattern-question/300934/3 "2022-03-30T02:22:26Z")

</div>

So if I want a combination of { and ", I should just do multiline.pattern '^{|^"' right?

---

<div class="post-metadata">

### Author: ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)
#### Post date: [March 30, 2022, 2:33am UTC](https://discuss.elastic.co/t/newcomer-multiline-pattern-question/300934/4 "2022-03-30T02:33:36Z")

</div>

Idk if that will work. I'd do `^({|")`

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 27, 2022, 4:33am UTC](https://discuss.elastic.co/t/newcomer-multiline-pattern-question/300934/5 "2022-04-27T04:33:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.