# Not able to filter from filebeat

**URL:** <https://discuss.elastic.co/t/not-able-to-filter-from-filebeat/215770>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [January 20, 2020, 3:49pm UTC](https://discuss.elastic.co/t/not-able-to-filter-from-filebeat/215770 "2020-01-20T15:49:16Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![surya1](https://avatars.discourse-cdn.com/v4/letter/s/6a8cbe/32.png) [@surya1](https://discuss.elastic.co/u/surya1)\
**Post date:** [January 20, 2020, 3:49pm UTC](https://discuss.elastic.co/t/not-able-to-filter-from-filebeat/215770/1 "2020-01-20T15:49:16Z")

</div>

Hi ,

I have a log a file that has 10-12 lines per paragraph and this same pattern repeats.

From this log file I need to select only 4-5 lines . Tried to use include lines but in elastic search i am not getting these as a single filtered message. instead it is coming as multiple messages.

Eg:

This is my line#1  
This is my line#2  
Yes line number3  
..  
..  
This is my lastline.

Here I have to get only line number 3 and the last line. Added include lines with corresponding regular expressions and it is working. But the issue is elastic search shows "Yes line number3" and "This is my lastline." as two separate lines/indexes. How can I get it as a single message like:

"Yes line number3  
This is my lastline."

---

<div class="post-metadata">

**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\
**Post date:** [January 20, 2020, 4:45pm UTC](https://discuss.elastic.co/t/not-able-to-filter-from-filebeat/215770/2 "2020-01-20T16:45:59Z")

</div>

Hi @surya1 and welcome to discuss! 🙂

Did you try [multiline options](https://www.elastic.co/guide/en/beats/filebeat/7.5/multiline-examples.html)? Though I am afraid that it won't work in your case, because you need first to filter-out lines with `include_lines`/`exclude_lines`, and then join lines. But `multiline` rules are applied before filtering.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 17, 2020, 4:46pm UTC](https://discuss.elastic.co/t/not-able-to-filter-from-filebeat/215770/3 "2020-02-17T16:46:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.