# Question on filebeat multiline pattern
**URL:** https://discuss.elastic.co/t/question-on-filebeat-multiline-pattern/171134
**Category:** Beats
**Tags:** filebeat
**Created:** [March 6, 2019, 2:28pm UTC](https://discuss.elastic.co/t/question-on-filebeat-multiline-pattern/171134 "2019-03-06T14:28:43Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@pk.241011](https://discuss.elastic.co/u/pk.241011)
#### Post date: [March 6, 2019, 2:28pm UTC](https://discuss.elastic.co/t/question-on-filebeat-multiline-pattern/171134/1 "2019-03-06T14:28:43Z")
I am trying to get the logs from a legacy system into Elastic via Filebeat. Needless to say it is the so called "Log from Hell". Since it is a csv I am using grok to great relief.
There is one thing which is bothering me. The exceptions which are also getting dumped. This is one example
```
"2018/08/28 15:16:35.516","DEBUG","16","318219","Read","Data Fetching","121020","0","KKMR","","","(null)","",
"2018/08/28 15:16:56.464","ERROR","16","339166","Error","Data Fetching","141967","(null)","Failed to write value to JJMR","(null)","(null)","EER102","SMT.Errors.ModuleException: EER102-Failed to write value to UP for SetJTCCommand: R
at SMT.Device\KalsJen.cs:line 1614
at SMT.File.cs:line 30
at SMT.SAMTStep.cs:line 39
at SMT.Step.Simulator.Execute() in C:\JJSEN\SMT\Tips.cs:line 41
",
```
This is my filebeat input section for multiline.
```
exclude_lines: ['^DATE']
multiline.pattern: '^\"'
multiline.negate: true
multiline.match: after
```
I am pushing the last field into exception field as below in grok.
```
%{QUOTEDSTRING:exception}
```
However notice the last line, that naughty little double quote followed by the comma. The exception was dumped with a trailing newline. And I get error since the last double quote is not appended to the exception text.
Is it possible to include both strings not starting with `"` or starting with value `",` both to be appended?
That way I will get an exception text which will be closed in double quotes. RIght now I get the exception string starting with `"` but not ending with one.
I am trying to create a multiline pattern for that but regex is not my strong point.
---
### Author:  [@pierhugues](https://discuss.elastic.co/u/pierhugues)
#### Post date: [March 6, 2019, 2:46pm UTC](https://discuss.elastic.co/t/question-on-filebeat-multiline-pattern/171134/2 "2019-03-06T14:46:45Z")
@pk.241011 CSV is a bit of a pain to work with so many exceptions with format and encoding, I wonder in that case if the [ingest-csv](https://github.com/johtani/elasticsearch-ingest-csv) plugin would be a good fit. It's not part of the official ingest node processors but its developed by a colleague.
---
### Author:  [@pk.241011](https://discuss.elastic.co/u/pk.241011)
#### Post date: [March 7, 2019, 12:14am UTC](https://discuss.elastic.co/t/question-on-filebeat-multiline-pattern/171134/3 "2019-03-07T00:14:31Z")
Thanks for this one. Is it going to be a part of later release? Just wondering if it can keep up with the scale and has it been tested well. This is production enviroment I am dealing with here.
---
### Author:  [@pierhugues](https://discuss.elastic.co/u/pierhugues)
#### Post date: [March 7, 2019, 2:08pm UTC](https://discuss.elastic.co/t/question-on-filebeat-multiline-pattern/171134/4 "2019-03-07T14:08:24Z")
I am not sure about the scaling factor for the above ingest plugins, but are you running Logstash as part of your stack? If yes, Logstash has a [csv filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-csv.html) which is part of the official release and will scale.
---
### Author:  [@pk.241011](https://discuss.elastic.co/u/pk.241011)
#### Post date: [March 7, 2019, 7:12pm UTC](https://discuss.elastic.co/t/question-on-filebeat-multiline-pattern/171134/5 "2019-03-07T19:12:58Z")
Thanks. Will try with logstash.
---
### Author:  [@pierhugues](https://discuss.elastic.co/u/pierhugues)
#### Post date: [March 7, 2019, 9:12pm UTC](https://discuss.elastic.co/t/question-on-filebeat-multiline-pattern/171134/6 "2019-03-07T21:12:04Z")
I don't know if the CSV processor will be part of the official release or not, you might want to create an issue on the CSV repository.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 4, 2019, 9:19pm UTC](https://discuss.elastic.co/t/question-on-filebeat-multiline-pattern/171134/7 "2019-04-04T21:19:03Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.