# Problems using multiline configurations

**URL:** <https://discuss.elastic.co/t/problems-using-multiline-configurations/309991>\
**Category:** Beats\
**Tags:** docker, filebeat\
**Created:** [July 19, 2022, 8:17am UTC](https://discuss.elastic.co/t/problems-using-multiline-configurations/309991 "2022-07-19T08:17:16Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Hkh9966](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hkh9966/32/108494_2.png) [@Hkh9966](https://discuss.elastic.co/u/Hkh9966)\
**Post date:** [July 19, 2022, 8:17am UTC](https://discuss.elastic.co/t/problems-using-multiline-configurations/309991/1 "2022-07-19T08:17:16Z")

</div>

hello guys!  
I would like to ask a question about multi-line merging. I tried to test using the example provided by the official, but it didn't work.This is the link : [Manage multiline messages | Filebeat Reference [8.3] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html) .

 ![屏幕截图 2022-07-19 161112](https://us1.discourse-cdn.com/elastic/original/3X/a/e/aef8a3600c32c26be8c3c15a1ef70bee6aacb2f9.png)

I'll provide my runtime and configuration files:

- ENV: docker
- filebeat.yml:

```auto
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /var/log/sleuthlog/*.log

filebeat.config:
  modules:
    path: ${path.config}/modules.d/*.yml
    reload.enabled: false

processors:
- add_cloud_metadata: ~
- add_docker_metadata: ~

multiline.type: pattern
multiline.pattern: '^\['
multiline.negate: true
multiline.match: after

output.console:
   pretty: true
   enable: true

```

Obviously, the console printed logs are not merged:

 ![屏幕截图 2022-07-19 161522](https://us1.discourse-cdn.com/elastic/original/3X/8/5/85d7632120cd8e45ab6fcae34decabfe7213601c.png)  
 ![屏幕截图 2022-07-19 161540](https://us1.discourse-cdn.com/elastic/original/3X/c/8/c86d8a7ca2847edbcd866a80c368eb5a4097eeb6.png)

Looking forward to your reply, this is very important to me Thank you!

---

<div class="post-metadata">

**Author:** ![Hkh9966](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hkh9966/32/108494_2.png) [@Hkh9966](https://discuss.elastic.co/u/Hkh9966)\
**Post date:** [July 19, 2022, 8:24am UTC](https://discuss.elastic.co/t/problems-using-multiline-configurations/309991/2 "2022-07-19T08:24:21Z")

</div>

Sorry , I forgot the filbeat version : 7.5.1 😄

---

<div class="post-metadata">

**Author:** ![mtojek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mtojek/32/63863_2.png) [@mtojek](https://discuss.elastic.co/u/mtojek)\
**Post date:** [July 19, 2022, 10:02am UTC](https://discuss.elastic.co/t/problems-using-multiline-configurations/309991/3 "2022-07-19T10:02:05Z")

</div>

There were many code changes since version 7.5.1. Have you tried to use the latest filebeat version?

---

<div class="post-metadata">

**Author:** ![lzold\_z](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lzold_z/32/108411_2.png) [@lzold\_z](https://discuss.elastic.co/u/lzold_z)\
**Post date:** [July 20, 2022, 7:43am UTC](https://discuss.elastic.co/t/problems-using-multiline-configurations/309991/4 "2022-07-20T07:43:16Z")

</div>

Have you tried place the multiline like example below ?  
because yaml files are very sensitive

```auto
- type: log
  enabled: true
  paths:
    - "path/to/monitor"
  multiline.type: pattern
  multiline.pattern: '^\['
  multiline.negate: true
  multiline.match: after

```

---

<div class="post-metadata">

**Author:** ![Hkh9966](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hkh9966/32/108494_2.png) [@Hkh9966](https://discuss.elastic.co/u/Hkh9966)\
**Post date:** [July 20, 2022, 8:06am UTC](https://discuss.elastic.co/t/problems-using-multiline-configurations/309991/5 "2022-07-20T08:06:33Z")

</div>

I have tried the solution that you said, it works well, thanks!!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 17, 2022, 10:07am UTC](https://discuss.elastic.co/t/problems-using-multiline-configurations/309991/6 "2022-08-17T10:07:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.