# Trouble getting multiline working

**URL:** <https://discuss.elastic.co/t/trouble-getting-multiline-working/50869>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 24, 2016, 4:11pm UTC](https://discuss.elastic.co/t/trouble-getting-multiline-working/50869 "2016-05-24T16:11:53Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![vchav73](https://avatars.discourse-cdn.com/v4/letter/v/f475e1/32.png) [@vchav73](https://discuss.elastic.co/u/vchav73)\
**Post date:** [May 24, 2016, 4:11pm UTC](https://discuss.elastic.co/t/trouble-getting-multiline-working/50869/1 "2016-05-24T16:11:53Z")

</div>

I have this in a log file:

```
2016-05-24 08:39:14 18083 [Note] /usr/sbin/mysqld: ready for connections.
Version: '5.6.29-76.2-log' socket: '/var/lib/mysql/mysql.sock' port: 3306 Percona Server (GPL), Release 76.2, Revision ddf26fe
2016-05-24 08:43:46 18083 [Note] /usr/sbin/mysqld: Normal shutdown

```

The second line belongs to the event started on the first line. I'm using this filebeat config:

```
filebeat:
  prospectors:
    -
      paths:
        - /var/log/mysql/error.log
      multiline:
        pattern: '[[:digit:]][[:digit:]][[:digit:]][[:digit:]]'
        negate: true
        match: after
      input_type: log
      document_type: mysql-error

```

When I look at the results in Elasticsearch I don't get what I expected. There are three events, one for each line. What I expected was that the second line will have been concatenated to the first line. Is this not what the multiline option is supposed to do?

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [May 24, 2016, 9:01pm UTC](https://discuss.elastic.co/t/trouble-getting-multiline-working/50869/2 "2016-05-24T21:01:32Z")

</div>

your pattern basically says: find me 4 consecutive digits per line. The second line contains port number 3306 and will match.

Use the `^` operator at beginning of your regex. This changes your pattern to: find me 4 consecutive digits at beginning of line.

You can shorten the pattern into `^[0-9]{4}`.

---

<div class="post-metadata">

**Author:** ![vchav73](https://avatars.discourse-cdn.com/v4/letter/v/f475e1/32.png) [@vchav73](https://discuss.elastic.co/u/vchav73)\
**Post date:** [May 24, 2016, 10:25pm UTC](https://discuss.elastic.co/t/trouble-getting-multiline-working/50869/3 "2016-05-24T22:25:41Z")

</div>

Your suggestion did the trick. Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 9:51pm UTC](https://discuss.elastic.co/t/trouble-getting-multiline-working/50869/4 "2017-07-05T21:51:32Z")

</div>