# Not able to multiline this Log on the basis of timestamp pattern **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [November 3, 2016, 9:56am UTC](https://discuss.elastic.co/t/not-able-to-multiline-this-log-on-the-basis-of-timestamp-pattern/64833 "2016-11-03T09:56:41Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![NITIN-BHAISARE](https://avatars.discourse-cdn.com/v4/letter/n/c89c15/32.png) [@NITIN-BHAISARE](https://discuss.elastic.co/u/NITIN-BHAISARE)\ **Post date:** [November 3, 2016, 9:56am UTC](https://discuss.elastic.co/t/not-able-to-multiline-this-log-on-the-basis-of-timestamp-pattern/64833/1 "2016-11-03T09:56:41Z")
Greetings, I was trying to handle following kind of logs with multiline. I am not able to get all events starting from timestamp. Could somebody please help me in making a good multiline pattern to get all the stack traces into single event. > 2016-11-01 20:03:43,249 - ERROR - blackcole\_abc.service.abcService - 8538490c-8a6e-4ad9-8397-30f636a6e924 - Cannot store data in abc: Failed abc API POST request [https://writer.com/abc](https://writer.com/abc) status code = 400, re > ason = Bad Request > Traceback (most recent call last): > File "/opt/rh/python27/root/usr/lib/python2.7/site-packages/blackcole\_abc/service.py", line 44, in write > timestamp=str(int(epoc)) > File "/opt/rh/python27/root/usr/lib/python2.7/site-packages/blackcole\_abc/api\_client.py", line 53, in submit > url, result.status\_code, result.reason)) > abcWriterClientError: Failed abc API POST request [https://writer.com/abc](https://writer.com/abc) status code = 400, reason = Bad Request > 2016-11-01 20:03:43,250 - ERROR - blackcole\_abc.service.abcService - 8538490c-8a6e-4ad9-8397-30f636a6e924 - Cannot write message > Traceback (most recent call last): > File "/opt/rh/python27/root/usr/lib/python2.7/site-packages/blackcole/core.py", line 167, in on\_message > self.write(processed, properties.correlation\_id, headers) > File "/opt/rh/python27/root/usr/lib/python2.7/site-packages/blackcole\_abc/service.py", line 49, in write > raise e > abcWriterClientError: Failed abc API POST request [https://writer.com/abc](https://writer.com/abc) status code = 400, reason = Bad Request Thank You Nitin Bhaisare ---
**Author:** ![NITIN-BHAISARE](https://avatars.discourse-cdn.com/v4/letter/n/c89c15/32.png) [@NITIN-BHAISARE](https://discuss.elastic.co/u/NITIN-BHAISARE)\ **Post date:** [November 3, 2016, 10:15am UTC](https://discuss.elastic.co/t/not-able-to-multiline-this-log-on-the-basis-of-timestamp-pattern/64833/2 "2016-11-03T10:15:35Z")
![](https://us1.discourse-cdn.com/elastic/original/2X/2/249e57c572c74796532a06c051c832f958bb8844.png) ---
**Author:** ![vvs14](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vvs14/32/11328_2.png) [@vvs14](https://discuss.elastic.co/u/vvs14)\ **Post date:** [November 3, 2016, 10:34am UTC](https://discuss.elastic.co/t/not-able-to-multiline-this-log-on-the-basis-of-timestamp-pattern/64833/3 "2016-11-03T10:34:50Z")
Grok Pattern > (?m)%{TIMESTAMP\_ISO8601:timestamp}\s\*-\s\*%{LOGLEVEL\_TEST:level}\s\*-\s\*%{GREEDYDATA:restOfMsg} > LOGLEVEL\_TEST (ERROR|[E|e]rror) Multiline pattern: `^%{TIMESTAMP_ISO8601}` Check on this link: [http://grokconstructor.appspot.com/do/match](http://grokconstructor.appspot.com/do/match) ---
**Author:** ![NITIN-BHAISARE](https://avatars.discourse-cdn.com/v4/letter/n/c89c15/32.png) [@NITIN-BHAISARE](https://discuss.elastic.co/u/NITIN-BHAISARE)\ **Post date:** [November 3, 2016, 11:02am UTC](https://discuss.elastic.co/t/not-able-to-multiline-this-log-on-the-basis-of-timestamp-pattern/64833/4 "2016-11-03T11:02:44Z")
Thanks @vvs14 ....you saved me 😌 This worked Actually I am very new to ELK stack. so i was stuck here for few days. 1 more question do i have to put following configuration in the filebeat.yml or in the logstash ? multiline.pattern: '^%{TIMESTAMP\_ISO8601}' multiline.negate: true multiline.match: after ---
**Author:** ![NITIN-BHAISARE](https://avatars.discourse-cdn.com/v4/letter/n/c89c15/32.png) [@NITIN-BHAISARE](https://discuss.elastic.co/u/NITIN-BHAISARE)\ **Post date:** [November 3, 2016, 12:27pm UTC](https://discuss.elastic.co/t/not-able-to-multiline-this-log-on-the-basis-of-timestamp-pattern/64833/5 "2016-11-03T12:27:09Z")
I put this configuration in the filebeat ![](https://us1.discourse-cdn.com/elastic/original/2X/b/bd6c8e7959cb6dfb239859b24f4199bd7949c51e.png) But it is still not taking stack trace as an single event. What am I missing My architecture is like below FILEBEAT --\> Logstash Shipper --\> RabbitMQ --\> Logstash Indexer --\>ES --\> Kibana Also the grok pattern i am using is > grok { > match =\> {"message" =\>"^%{TIMESTAMP\_ISO8601:timestamp}\s+-\s+%{LOGLEVEL:severity}\s+-\s+%{DATA:code\_unit}\s+-\s+((%{UUID:correlation\_id}\s+)?-\s+)?%{GREEDYDATA:message}$"} > overwrite =\> ["message"] > } > date { > match =\> ["timestamp" , "yyyy-MM-dd HH:mm:ss,SSS"] > } > } I cannot use Redis. So could you please tell me what am i missing?? ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [November 4, 2016, 7:43am UTC](https://discuss.elastic.co/t/not-able-to-multiline-this-log-on-the-basis-of-timestamp-pattern/64833/6 "2016-11-04T07:43:30Z")
Grok is not supported in Filebeat. If you want to use grok you must use Logstash. If you want to do the multiline on the filebeat side, you must use regexp. ---
**Author:** ![NITIN-BHAISARE](https://avatars.discourse-cdn.com/v4/letter/n/c89c15/32.png) [@NITIN-BHAISARE](https://discuss.elastic.co/u/NITIN-BHAISARE)\ **Post date:** [November 6, 2016, 9:51am UTC](https://discuss.elastic.co/t/not-able-to-multiline-this-log-on-the-basis-of-timestamp-pattern/64833/7 "2016-11-06T09:51:28Z")
@ruflin This is definitely the problem here. I checked the regexp but i am not getting any idea how to single event above multiline message. Could you please tell which regexp to use also can we use multiple regexp in filebeat?? ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [November 7, 2016, 5:33pm UTC](https://discuss.elastic.co/t/not-able-to-multiline-this-log-on-the-basis-of-timestamp-pattern/64833/8 "2016-11-07T17:33:36Z")
It's probably best that you have a look at the examples here. [https://www.elastic.co/guide/en/beats/filebeat/5.0/multiline-examples.html#\_examples\_of\_multiline\_configuration](https://www.elastic.co/guide/en/beats/filebeat/5.0/multiline-examples.html#_examples_of_multiline_configuration) ---
**Author:** ![NITIN-BHAISARE](https://avatars.discourse-cdn.com/v4/letter/n/c89c15/32.png) [@NITIN-BHAISARE](https://discuss.elastic.co/u/NITIN-BHAISARE)\ **Post date:** [November 8, 2016, 5:11pm UTC](https://discuss.elastic.co/t/not-able-to-multiline-this-log-on-the-basis-of-timestamp-pattern/64833/9 "2016-11-08T17:11:19Z")
@ruflin Thanks i will try this ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 24, 2016, 9:57am UTC](https://discuss.elastic.co/t/not-able-to-multiline-this-log-on-the-basis-of-timestamp-pattern/64833/10 "2016-11-24T09:57:11Z")
This topic was automatically closed after 21 days. New replies are no longer allowed.