# Repeated message

**URL:** https://discuss.elastic.co/t/repeated-message/153737
**Category:** Beats
**Tags:** filebeat
**Created:** [October 24, 2018, 7:44am UTC](https://discuss.elastic.co/t/repeated-message/153737 "2018-10-24T07:44:26Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![herren\_marc](https://avatars.discourse-cdn.com/v4/letter/h/9e8a1a/32.png) [@herren\_marc](https://discuss.elastic.co/u/herren_marc)
#### Post date: [October 24, 2018, 7:44am UTC](https://discuss.elastic.co/t/repeated-message/153737/1 "2018-10-24T07:44:26Z")

</div>

Hi,  
I have a simple filebeat configuration sending the output of a tomcat server to my logstash

```
- type: log
  paths:
    - '/home/appserver/logs/catalina.out'
  tags: [swtp]

  multiline.pattern: '^[[:space:]]+(at|\.{3})\b|^Caused by:'
  multiline.negate: false
  multiline.match: after

```

My logstash filter is also rather simple

```
filter {
  if "swtp" in [tags] {
    grok {
      pattern_definitions => { "SWTPGENERIC" => "%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{HOUR}:?%{MINUTE}(?::?%{SECOND}) %{LOGLEVEL} \[%{WORD:java.method}\.%{WORD:java.class}] - <%{GREEDYDATA:message}>" }
      pattern_definitions => { "SWTPMAIL" => "%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{HOUR}:?%{MINUTE}(?::?%{SECOND}) %{LOGLEVEL} \[%{WORD:java.method}\.%{WORD:java.class}] - <sendMail %{WORD:transmit_status} %{GREEDYDATA:message}>" }
      
      pattern_definitions => { "EMAILADDRESSPART" => "[a-zA-Z0-9_.+-=:]+" }
      match => { "message" => "%{SWTPMAIL}|%{SWTPGENERIC}" }
    }
  }
}

```

The problem is that the applications outputs to following line  
2018-10-24 09:31:48,685 INFO [customer.mails] - \<sendMail OK to: [XXX.XXX@gmail.com](mailto:XXX.XXX@gmail.com) subject: Bestätigung Ihres Eintrags \>

But in ES I see the entry as

2018-10-24 09:31:48,685 INFO [customer.mails] - \<sendMail OK to: [XXX.XXX@gmail.com](mailto:XXX.XXX@gmail.com) subject: Bestätigung Ihres Eintrags\>, sendMail OK to: [XXX:XXX@gmail.com](mailto:XXX:XXX@gmail.com) subject: Bestätigung Ihres Eintrags

As logstash can not parse the message I suspect that filebeat is sending the log wrongly.  
The question is, why a second "sendMail OK to: [XXX:XXX@gmail.com](mailto:XXX:XXX@gmail.com) subject: Bestätigung Ihres Eintrags" is appended to the message.

Any clues?

---

<div class="post-metadata">

### Author: ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)
#### Post date: [October 25, 2018, 2:03pm UTC](https://discuss.elastic.co/t/repeated-message/153737/2 "2018-10-25T14:03:47Z")

</div>

> [@herren\_marc](#):
>
> 2018-10-24 09:31:48,685

I think the multiline pattern is wrong in your case, with your example I am not sure how they are applied. Did you try to match on a date format instead as the delimiter of new events?

---

<div class="post-metadata">

### Author: ![CyberSeppi](https://avatars.discourse-cdn.com/v4/letter/c/91b2a8/32.png) [@CyberSeppi](https://discuss.elastic.co/u/CyberSeppi)
#### Post date: [October 25, 2018, 6:28pm UTC](https://discuss.elastic.co/t/repeated-message/153737/3 "2018-10-25T18:28:31Z")

</div>

Multiline pattern was wrong, indeed ☹  
Many thanks for rubbing my nose into it 🙂 🙂

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 22, 2018, 6:43pm UTC](https://discuss.elastic.co/t/repeated-message/153737/4 "2018-11-22T18:43:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.