# Problem with filebeat, it does not process multiline correctly

**URL:** <https://discuss.elastic.co/t/problem-with-filebeat-it-does-not-process-multiline-correctly/354425>\
**Category:** Elastic Agent\
**Tags:** filebeat\
**Created:** [February 29, 2024, 9:59am UTC](https://discuss.elastic.co/t/problem-with-filebeat-it-does-not-process-multiline-correctly/354425 "2024-02-29T09:59:59Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![San9](https://avatars.discourse-cdn.com/v4/letter/s/a9adbd/32.png) [@San9](https://discuss.elastic.co/u/San9)\
**Post date:** [February 29, 2024, 9:59am UTC](https://discuss.elastic.co/t/problem-with-filebeat-it-does-not-process-multiline-correctly/354425/1 "2024-02-29T09:59:59Z")

</div>

Hello.  
I have a problem setting up the filebeat agnet.  
The logs consist of several lines and I would like to send them as one message.  
I prepared the config, but for some reason it doesn’t work. tell me what the problem is?  
When writing a regular expression, I used [https://regex101.com](https://regex101.com). Everything looks good there, but the messages are still coming in the wrong form.

Parsing example

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/f/2f2d6d8db9329c2a57785f7ac6e90d3641712427.png)

Part of the config from filebeat 8.12.1

```auto
- type: filestream
  id: cc-vapp-oracle-attention
  tags: ["oracle-attention"]
  enabled: true
  ignore_older: 24h
  paths:
       - /opt/oracle/diag/rdbms/xe/XE/trace/attention_XE_Test*.log
  parsers:
    - multiline:
       type: pattern
       pattern: '^{'
       negate: true
       match: after
       flush_pattern: '^}'

```

and

```auto
- type: filestream
  id: cc-vapp-oracle-attention
  tags: ["oracle-attention"]
  enabled: true
  ignore_older: 24h
  paths:
       - /opt/oracle/diag/rdbms/xe/XE/trace/attention_XE_Test*.log
  parsers:
    - multiline:
       type: pattern
       pattern: ^\n[[:graph:]]\n "NOTIFICATION"'
       negate: true
       match: after
       flush_pattern: '^}'

```

example log:

```auto
{
  "NOTIFICATION" : "Starting ORACLE instance (normal) (OS id: 30427)",
  "URGENCY" : "INFO",
  "INFO" : "Additional Information Not Available",
  "CAUSE" : "A command to startup the instance was executed",
  "ACTION" : "Check alert log for progress and completion of command",
  "CLASS" : "CDB Instance / CDB ADMINISTRATOR / AL-1000",
  "TIME" : "2022-11-12T04:45:47.265+02:00"
}

{
  "NOTIFICATION" : "Shutting down ORACLE instance (immediate) (OS id: 30720)",
  "URGENCY" : "INFO",
  "INFO" : "Shutdown is initiated by sqlplus (TNS V1-V3). ",
  "CAUSE" : "A command to shutdown the instance was executed",
  "ACTION" : "Check alert log for progress and completion of command",
  "CLASS" : "CDB Instance / CDB ADMINISTRATOR / AL-1001",
  "TIME" : "2022-11-12T04:46:53.327+02:00"
}

{
  "NOTIFICATION" : "Starting ORACLE instance (normal) (OS id: 30723)",
  "URGENCY" : "INFO",
  "INFO" : "Additional Information Not Available",
  "CAUSE" : "A command to startup the instance was executed",
  "ACTION" : "Check alert log for progress and completion of command",
  "CLASS" : "CDB Instance / CDB ADMINISTRATOR / AL-1000",
  "TIME" : "2022-11-12T04:46:54.258+02:00"
}

```

---

<div class="post-metadata">

**Author:** ![ahmed\_charafouddine](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ahmed_charafouddine/32/45129_2.png) [@ahmed\_charafouddine](https://discuss.elastic.co/u/ahmed_charafouddine)\
**Post date:** [February 29, 2024, 10:58am UTC](https://discuss.elastic.co/t/problem-with-filebeat-it-does-not-process-multiline-correctly/354425/2 "2024-02-29T10:58:09Z")

</div>

Hello @San9

I tested the configuration below and it works fine.

```auto
- type: filestream
  id: my-filestream-id
  enabled: true
  paths:
    - example.txt
  parsers:
  - multiline:
      type: pattern
      pattern: '^\{'
      negate: true
      match: after

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 28, 2024, 10:58am UTC](https://discuss.elastic.co/t/problem-with-filebeat-it-does-not-process-multiline-correctly/354425/3 "2024-03-28T10:58:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.