# Unable to push multiline events from Filebeat to Logstash

**URL:** https://discuss.elastic.co/t/unable-to-push-multiline-events-from-filebeat-to-logstash/245343
**Category:** Beats
**Tags:** filebeat
**Created:** [August 18, 2020, 4:16am UTC](https://discuss.elastic.co/t/unable-to-push-multiline-events-from-filebeat-to-logstash/245343 "2020-08-18T04:16:10Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![asabhyak](https://avatars.discourse-cdn.com/v4/letter/a/90ced4/32.png) [@asabhyak](https://discuss.elastic.co/u/asabhyak)
#### Post date: [August 18, 2020, 4:16am UTC](https://discuss.elastic.co/t/unable-to-push-multiline-events-from-filebeat-to-logstash/245343/1 "2020-08-18T04:16:11Z")

</div>

Hi team,

I am doing a PoC on ELK and have come across an issue. I have had a look at many topics on [discuss.elastic.co](http://discuss.elastic.co) and StackOverflow, but none seems to have helped.

I am trying to configure multiline events via Filebeat and consuming them in Logstash. The issue that I am facing is that even after setting the multiline configuration, I still see the lines of a stacktrace as individual events in Logstash.

Since Logstash receives the lines of the stacktrace not as a single event but as individual lines, it is leading to a \_grokparsefailure at that end, which is completely understandable as FB should club those lines into the same event prior to sending them to Logstash.

Other single line events are working expectedly and I am able to visualise them on Kibana.

filebeat.yml:

```auto
filebeat.inputs:

  - type: s3
    queue_url: https://sqs.aaaaa.amazonaws.com/xxxxxxxx/zzzzzz
    visibility_timeout: 300s
    multiline.pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}'
    multiline.negate: true
    multiline.match: after

```

Logstash configuration:

```auto
input {
  beats {
    port => 5044
    host => "0.0.0.0"
  }
}

filter {
  grok {
    match => {"message" => "%{TIMESTAMP_ISO8601:timestamp} %{GREEDYDATA:logType} %{LOGLEVEL:logLevel}%{SPACE}\[%{GREEDYDATA:key1}\] \[%{GREEDYDATA:key2}\] \[%{GREEDYDATA:key3}\] \[%{GREEDYDATA:sourceIP}\] %{GREEDYDATA:message}"}
    overwrite => ["message"]
  } 

 date {
    match => ["timestamp", "yyyy-MM-dd HH:mm:ss,SSS"]
  }
}

```

Here is a sample log statement I am trying to combine into a single event:

```auto
2020-08-18 00:30:52,481 detailed_logs ERROR [abc] [xyz] [def] [127.0.0.1] Exception raised. Trace:
2020-08-18 00:30:52,483 detailed_logs ERROR Traceback (most recent call last):
  File "/Users/vvv/Documents/ttt.py", line 93, in get
    x = y.perform(abc)
  File "/Users/vvv/Documents/ttt.py", line 283, in operate
    raise exception
  File "/Users/vvv/Documents/ttt.py", line 169, in operate
    d["abb"] = n["xy"]
AttributeError: 'model' object has no attribute 'create1d_on'

```

Any nudge in the right direction would be appreciated. Thanks in advance.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 15, 2020, 6:16am UTC](https://discuss.elastic.co/t/unable-to-push-multiline-events-from-filebeat-to-logstash/245343/2 "2020-09-15T06:16:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.