# Parsing multiple lines CSV with filebeat & Logstash

**URL:** <https://discuss.elastic.co/t/parsing-multiple-lines-csv-with-filebeat-logstash/137070>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [June 22, 2018, 6:43pm UTC](https://discuss.elastic.co/t/parsing-multiple-lines-csv-with-filebeat-logstash/137070 "2018-06-22T18:43:24Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![TestCandidate](https://avatars.discourse-cdn.com/v4/letter/t/8dc957/32.png) [@TestCandidate](https://discuss.elastic.co/u/TestCandidate)\
**Post date:** [June 22, 2018, 6:43pm UTC](https://discuss.elastic.co/t/parsing-multiple-lines-csv-with-filebeat-logstash/137070/1 "2018-06-22T18:43:24Z")

</div>

Hey Guys,

I have a CSV file that looks like the attached image.

 ![Capture](https://us1.discourse-cdn.com/elastic/original/3X/7/b/7bc826efaa2cb82e71b73e6c2bfd2af91682103f.JPG)

I want to send this csv file to logstash.  
The configuration is working well except that the whole file is being sent as a single message. filebeat is not splitting the lines.

I saw the multiline option in the docs. But I'm not sure on what to use for my file.  
What would you recommend? should i match LF (end of line char? ) or how can I proceed?

Here's the configuration now:  
filebeat.prospectors:

```
- type: log
  enabled: true
  paths:
     - /var/capture/test/*.csv
  tags: ["iclick-tcplog"]

  multiline.pattern: ',\d+,[^\",]+$'
  multiline.negate: true
  multiline.match: before
```

---

<div class="post-metadata">

**Author:** ![TestCandidate](https://avatars.discourse-cdn.com/v4/letter/t/8dc957/32.png) [@TestCandidate](https://discuss.elastic.co/u/TestCandidate)\
**Post date:** [June 24, 2018, 8:37am UTC](https://discuss.elastic.co/t/parsing-multiple-lines-csv-with-filebeat-logstash/137070/2 "2018-06-24T08:37:08Z")

</div>

A better understanding of multiline shows that i didn't need it at all. problem solved by omitting all the multiline options.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 22, 2018, 8:37am UTC](https://discuss.elastic.co/t/parsing-multiple-lines-csv-with-filebeat-logstash/137070/3 "2018-07-22T08:37:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.