# \[Solved\] Possible bug? filebeat multiline regexp
**URL:** https://discuss.elastic.co/t/solved-possible-bug-filebeat-multiline-regexp/40953
**Category:** Beats
**Tags:** filebeat
**Created:** [February 4, 2016, 11:51am UTC](https://discuss.elastic.co/t/solved-possible-bug-filebeat-multiline-regexp/40953 "2016-02-04T11:51:39Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@mikula](https://discuss.elastic.co/u/mikula)
#### Post date: [February 4, 2016, 11:51am UTC](https://discuss.elastic.co/t/solved-possible-bug-filebeat-multiline-regexp/40953/1 "2016-02-04T11:51:39Z")
Hi again,
I have possible bug in filebeat multiline regexp pattern matching.
`"^\[?[0-9][0-9]:?[0-9][0-9]|^[[:graph:]]+"`
(note quotes) Fails with unknown escape character
But:
`^\[?[0-9][0-9]:?[0-9][0-9]|^[[:graph:]]+`
works
---
### Author:  [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [February 4, 2016, 1:42pm UTC](https://discuss.elastic.co/t/solved-possible-bug-filebeat-multiline-regexp/40953/2 "2016-02-04T13:42:57Z")
YAML has some string escaping rules depending on how strings are put into the document. Personally I prefer to put regexes in single quotes like `^\[?[0-9][0-9]:?[0-9][0-9]|^[[:graph:]]+` . This is no bug per se, but how YAML file format is specified.
---
### Author:  [@mikula](https://discuss.elastic.co/u/mikula)
#### Post date: [February 4, 2016, 2:56pm UTC](https://discuss.elastic.co/t/solved-possible-bug-filebeat-multiline-regexp/40953/3 "2016-02-04T14:56:32Z")
Thank you for explanation.
AM
---
### Author:  [@bsam](https://discuss.elastic.co/u/bsam)
#### Post date: [February 11, 2016, 2:20pm UTC](https://discuss.elastic.co/t/solved-possible-bug-filebeat-multiline-regexp/40953/4 "2016-02-11T14:20:10Z")
So, then the example for the multiline option [here] ([https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-configuration-details.html#multiline](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-configuration-details.html#multiline)) (right after the phrase "Here’s an example configuration that shows the regular expression for a slightly more complex example:") should be fixed.
---
### Author:  [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [February 12, 2016, 12:57pm UTC](https://discuss.elastic.co/t/solved-possible-bug-filebeat-multiline-regexp/40953/5 "2016-02-12T12:57:09Z")
I think the example is right by escaping the '[' character using ''. The pattern can be rewritten to `'^['` though.
---
### Author:  [@bsam](https://discuss.elastic.co/u/bsam)
#### Post date: [February 12, 2016, 1:25pm UTC](https://discuss.elastic.co/t/solved-possible-bug-filebeat-multiline-regexp/40953/6 "2016-02-12T13:25:40Z")
Steffen, seems that I was not strict at my message. Let me try once more. I meant not the example you think of but a little bit further one.
The topic is about double quotes and regexp patterns. You say that double quotes should be avoided at regexp patterns. The documentation (I gave the link in my previous reply) has an example with quotes. BTW, I mean the multiline pattern `pattern: "^[[:space:]]+(at|...)|^Caused by:"` (mind my note "right after the phrase"... at my previous message).
Boris (tried hard to be more precise. 🙂)
---
### Author:  [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [February 12, 2016, 4:59pm UTC](https://discuss.elastic.co/t/solved-possible-bug-filebeat-multiline-regexp/40953/7 "2016-02-12T16:59:15Z")
I see. Have to test this one. It might work (I think we tested these before putting them into docs). If double-quotes are used in YAML other escaping rules are in place. Anyway, we should always document regex examples with single quotes so not to confuse people.
---
### Author:  [@dedemorton](https://discuss.elastic.co/u/dedemorton)
#### Post date: [February 12, 2016, 5:04pm UTC](https://discuss.elastic.co/t/solved-possible-bug-filebeat-multiline-regexp/40953/8 "2016-02-12T17:04:18Z")
The examples in the doc have been tested, but I agree that our examples should follow our recommendations.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2017, 9:55pm UTC](https://discuss.elastic.co/t/solved-possible-bug-filebeat-multiline-regexp/40953/9 "2017-07-05T21:55:46Z")