# Not able to get multiline pattern properly for my log message

**URL:** <https://discuss.elastic.co/t/not-able-to-get-multiline-pattern-properly-for-my-log-message/368887>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [October 16, 2024, 7:14am UTC](https://discuss.elastic.co/t/not-able-to-get-multiline-pattern-properly-for-my-log-message/368887 "2024-10-16T07:14:37Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bhanu\_Praveen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bhanu_praveen/32/60395_2.png) [@Bhanu\_Praveen](https://discuss.elastic.co/u/Bhanu_Praveen)\
**Post date:** [October 16, 2024, 7:14am UTC](https://discuss.elastic.co/t/not-able-to-get-multiline-pattern-properly-for-my-log-message/368887/1 "2024-10-16T07:14:37Z")

</div>

Hello,

Below is my log msg where i need to split multiline with "[gc]" text. Tried some options which doesn't work. Pls let me know the issue

```auto

[2024-10-16T00:52:58.870+0000][0.013s][gc] Using G1
[2024-10-16T00:53:05.153+0000][6.296s][gc,heap] GC(0) Heap before GC invocations=0 (full 0):
[2024-10-16T00:52:58.870+0000][0.013s][gc] Using G1
[2024-10-16T00:53:05.153+0000][6.296s][gc,heap] GC(0) Heap before GC invocations=0 (full 0):
[2024-10-16T00:52:58.870+0000][0.013s][gc] Using G1
[2024-10-16T00:53:05.153+0000][6.296s][gc,heap] GC(0) Heap before GC invocations=0 (full 0):

```

Tried as below which didn't work

```auto

 multiline.pattern: '\[gc(.)*?'

```

---

<div class="post-metadata">

**Author:** ![ashishtiwari1993](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ashishtiwari1993/32/135241_2.png) [@ashishtiwari1993](https://discuss.elastic.co/u/ashishtiwari1993)\
**Post date:** [October 16, 2024, 8:19am UTC](https://discuss.elastic.co/t/not-able-to-get-multiline-pattern-properly-for-my-log-message/368887/2 "2024-10-16T08:19:10Z")

</div>

H @Bhanu_Praveen, Are you using logstash to parse the same?

---

<div class="post-metadata">

**Author:** ![Bhanu\_Praveen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bhanu_praveen/32/60395_2.png) [@Bhanu\_Praveen](https://discuss.elastic.co/u/Bhanu_Praveen)\
**Post date:** [October 16, 2024, 8:42am UTC](https://discuss.elastic.co/t/not-able-to-get-multiline-pattern-properly-for-my-log-message/368887/3 "2024-10-16T08:42:25Z")

</div>

Filebeats as tagged..

```auto
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - "/opt/micro_service/TA/MOUNT/gc_logs/s1gc3.log"
  multiline.pattern: '\[gc(.)*?'
  multiline.negate: true
  multiline.match: before
  max_bytes: 10485760
  fields:
    index: hc-gc
    hc_type: gc-log

```