# Problem with Tomcat multiline entries **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [May 31, 2017, 2:48pm UTC](https://discuss.elastic.co/t/problem-with-tomcat-multiline-entries/87768 "2017-05-31T14:48:21Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![hanover23](https://avatars.discourse-cdn.com/v4/letter/h/a183cd/32.png) [@hanover23](https://discuss.elastic.co/u/hanover23)\ **Post date:** [May 31, 2017, 2:48pm UTC](https://discuss.elastic.co/t/problem-with-tomcat-multiline-entries/87768/1 "2017-05-31T14:48:22Z")
Hey all - I'm trying to get filebeats to forward some of my Tomcat logs, but I can't seem to get the multiline stuff quite right. The log file is a mix of single-line entries and multiline. Any help would be appreciated. Here is my config for multiline: ``` multiline.pattern: '^[[:space:]]' multiline.pattern: '^[[:space:]]+|^Caused by:' multiline.negate: true multiline.match: after ``` Here is an example of the logs I'm trying to get consumed by filebeats: ``` 22-May-2017 11:32:03.854 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log Command line argument: -Dcatalina.base=/srv/app/tomcat/tomcat1 22-May-2017 11:32:03.855 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log Command line argument: -Dcatalina.home=/usr/share/tomcat8 22-May-2017 11:32:03.855 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log Command line argument: -Djava.endorsed.dirs= 22-May-2017 11:32:03.855 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log Command line argument: -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager 22-May-2017 11:32:03.855 INFO [main] org.apache.catalina.core.AprLifecycleListener.lifecycleEvent The APR based Apache Tomcat Native library which allows optimal performance in production environments was not found on the java.library.pa th: /usr/java/packages/lib/amd64:/usr/lib64:/lib64:/lib:/usr/lib 22-May-2017 11:32:04.988 INFO [main] org.apache.coyote.AbstractProtocol.init Initializing ProtocolHandler ["http-nio-8082"] 22-May-2017 11:32:05.352 INFO [main] org.apache.tomcat.util.net.NioSelectorPool.getSharedSelector Using a shared selector for servlet write/read 22-May-2017 11:32:05.431 INFO [main] org.apache.coyote.AbstractProtocol.init Initializing ProtocolHandler ["ajp-nio-8009"] 22-May-2017 11:32:05.432 INFO [main] org.apache.tomcat.util.net.NioSelectorPool.getSharedSelector Using a shared selector for servlet write/read 22-May-2017 11:32:05.470 INFO [main] org.apache.catalina.startup.Catalina.load Initialization processed in 4755 ms 22-May-2017 11:32:12.299 WARNING [main] org.apache.naming.NamingContext.lookup Unexpected exception resolving reference java.sql.SQLException: Cannot create PoolableConnectionFactory (IO Error: The Network Adapter could not establish the connection) at org.apache.tomcat.dbcp.dbcp2.BasicDataSource.createPoolableConnectionFactory(BasicDataSource.java:2294) at org.apache.tomcat.dbcp.dbcp2.BasicDataSource.createDataSource(BasicDataSource.java:2038) at org.apache.tomcat.dbcp.dbcp2.BasicDataSource.getLogWriter(BasicDataSource.java:1587) at org.apache.tomcat.dbcp.dbcp2.BasicDataSourceFactory.createDataSource(BasicDataSourceFactory.java:594) at org.apache.tomcat.dbcp.dbcp2.BasicDataSourceFactory.getObjectInstance(BasicDataSourceFactory.java:274) at org.apache.naming.factory.FactoryBase.getObjectInstance(FactoryBase.java:94) at javax.naming.spi.NamingManager.getObjectInstance(NamingManager.java:321) at org.apache.naming.NamingContext.lookup(NamingContext.java:841) at org.apache.naming.NamingContext.lookup(NamingContext.java:152) at org.apache.naming.NamingContext.lookup(NamingContext.java:829) at org.apache.naming.NamingContext.lookup(NamingContext.java:166) at org.apache.catalina.core.NamingContextListener.addResource(NamingContextListener.java:1091) at org.apache.catalina.core.NamingContextListener.createNamingContext(NamingContextListener.java:670) at org.apache.catalina.core.NamingContextListener.lifecycleEvent(NamingContextListener.java:258) at org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(LifecycleSupport.java:95) at org.apache.catalina.util.LifecycleBase.fireLifecycleEvent(LifecycleBase.java:90) at org.apache.catalina.core.StandardServer.startInternal(StandardServer.java:781) at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:147) at org.apache.catalina.startup.Catalina.start(Catalina.java:629) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.apache.catalina.startup.Bootstrap.start(Bootstrap.java:351) at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:485) Caused by: java.sql.SQLRecoverableException: IO Error: The Network Adapter could not establish the connection at oracle.jdbc.driver.T4CConnection.logon(T4CConnection.java:743) at oracle.jdbc.driver.PhysicalConnection.connect(PhysicalConnection.java:666) at oracle.jdbc.driver.T4CDriverExtension.getConnection(T4CDriverExtension.java:32) at oracle.jdbc.driver.OracleDriver.connect(OracleDriver.java:566) at org.apache.tomcat.dbcp.dbcp2.DriverConnectionFactory.createConnection(DriverConnectionFactory.java:38) at org.apache.tomcat.dbcp.dbcp2.PoolableConnectionFactory.makeObject(PoolableConnectionFactory.java:255) at org.apache.tomcat.dbcp.dbcp2.BasicDataSource.validateConnectionFactory(BasicDataSource.java:2304) at org.apache.tomcat.dbcp.dbcp2.BasicDataSource.createPoolableConnectionFactory(BasicDataSource.java:2290) ... 24 more Caused by: oracle.net.ns.NetException: The Network Adapter could not establish the connection at oracle.net.nt.ConnStrategy.execute(ConnStrategy.java:470) at oracle.net.resolver.AddrResolution.resolveAndExecute(AddrResolution.java:506) at oracle.net.ns.NSProtocol.establishConnection(NSProtocol.java:595) at oracle.net.ns.NSProtocol.connect(NSProtocol.java:230) at oracle.jdbc.driver.T4CConnection.connect(T4CConnection.java:1452) at oracle.jdbc.driver.T4CConnection.logon(T4CConnection.java:496) ... 31 more Caused by: java.net.NoRouteToHostException: No route to host (Host unreachable) at java.net.PlainSocketImpl.socketConnect(Native Method) at java.net.AbstractPlainSocketImpl.doConnect(AbstractPlainSocketImpl.java:350) at oracle.net.nt.TcpNTAdapter.connect(TcpNTAdapter.java:161) at oracle.net.nt.ConnOption.connect(ConnOption.java:159) at oracle.net.nt.ConnStrategy.execute(ConnStrategy.java:428) ... 36 more ``` ---
**Author:** ![hanover23](https://avatars.discourse-cdn.com/v4/letter/h/a183cd/32.png) [@hanover23](https://discuss.elastic.co/u/hanover23)\ **Post date:** [June 1, 2017, 8:19pm UTC](https://discuss.elastic.co/t/problem-with-tomcat-multiline-entries/87768/2 "2017-06-01T20:19:58Z")
Switching negate to false gave me the behavior I was looking for - thanks! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 29, 2017, 8:20pm UTC](https://discuss.elastic.co/t/problem-with-tomcat-multiline-entries/87768/3 "2017-06-29T20:20:27Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.