# Understanding Multiline **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [March 9, 2017, 1:17am UTC](https://discuss.elastic.co/t/understanding-multiline/77920 "2017-03-09T01:17:48Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Louuu](https://avatars.discourse-cdn.com/v4/letter/l/dbc845/32.png) [@Louuu](https://discuss.elastic.co/u/Louuu)\ **Post date:** [March 9, 2017, 1:17am UTC](https://discuss.elastic.co/t/understanding-multiline/77920/1 "2017-03-09T01:17:48Z")
Hi, I have started using filebeat recently and have been looking at the multiline configurations as shown in the documentation. [https://play.golang.org/p/LQpFDR34t9](https://play.golang.org/p/LQpFDR34t9) According to that, my multiline regex works as expected. However it is returning as multiple lines as shown below and ignoring the multiline pattern which I have applied ☹ ``` `:{"type":"radiusdetail"},"input_type":"log","message":"Thu Mar 9 00:50:48 2017","offset":2389,"source":"/var/log/radius/radacct/10.122.217.4/detail-20170309","type":"log"} {"@timestamp":"2017-03-09T00:50:49.671Z","beat":{"hostname":"app.radius.local","name":"app.radius.local","version":"5.2.2"},"fields":{"type":"radiusdetail"},"input_type":"log","message":"\tUser-Name = 'test@test.co.uk'","offset":2438,"source":"/var/log/radius/radacct/10.122.217.4/detail-20170309","type":"log"} {"@timestamp":"2017-03-09T00:50:49.671Z","beat":{"hostname":"app.radius.local","name":"app.radius.local","version":"5.2.2"},"fields":{"type":"radiusdetail"},"input_type":"log","message":"\tAcct-Status-Type = Start","offset":2464,"source":"/var/log/radius/radacct/10.122.217.4/detail-20170309","type":"log"} {"@timestamp":"2017-03-09T00:50:49.671Z","beat":{"hostname":"app.radius.local","name":"app.radius.local","version":"5.2.2"},"fields":{"type":"radiusdetail"},"input_type":"log","message":"\tAcct-Session-Id = '1184'","offset":2490,"source":"/var/log/radius/radacct/10.122.217.4/detail-20170309","type":"log"} {"@timestamp":"2017-03-09T00:50:49.671Z","beat":{"hostname":"app.radius.local","name":"app.radius.local","version":"5.2.2"},"fields":{"type":"radiusdetail"},"input_type":"log","message":"\tFramed-IP-Address = 192.168.105.1","offset":2525,"source":"/var/log/radius/radacct/10.122.217.4/detail-20170309","type":"log"} {"@timestamp":"2017-03-09T00:50:49.671Z","beat":{"hostname":"app.radius.local","name":"app.radius.local","version":"5.2.2"},"fields":{"type":"radiusdetail"},"input_type":"log","message":"\tNAS-IP-Address = 192.168.1.1","offset":2555,"source":"/var/log/radius/radacct/10.122.217.4/detail-20170309","type":"log"} {"@timestamp":"2017-03-09T00:50:49.671Z","beat":{"hostname":"app.radius.local","name":"app.radius.local","version":"5.2.2"},"fields":{"type":"radiusdetail"},"input_type":"log","message":"\tCalling-Station-Id = '192.168.1.1'","offset":2591,"source":"/var/log/radius/radacct/10.122.217.4/detail-20170309","type":"log"} {"@timestamp":"2017-03-09T00:50:49.671Z","beat":{"hostname":"app.radius.local","name":"app.radius.local","version":"5.2.2"},"fields":{"type":"radiusdetail"},"input_type":"log","message":"\tCalled-Station-Id = '192.168.1.1'","offset":2626,"source":"/var/log/radius/radacct/10.122.217.4/detail-20170309","type":"log"} {"@timestamp":"2017-03-09T00:50:49.671Z","beat":{"hostname":"app.radius.local","name":"app.radius.local","version":"5.2.2"},"fields":{"type":"radiusdetail"},"input_type":"log","message":"\tEvent-Timestamp = 'Mar 9 2017 00:50:48 GMT'","offset":2672,"source":"/var/log/radius/radacct/10.122.217.4/detail-20170309","type":"log"} {"@timestamp":"2017-03-09T00:50:49.671Z","beat":{"hostname":"app.radius.local","name":"app.radius.local","version":"5.2.2"},"fields":{"type":"radiusdetail"},"input_type":"log","message":"\tAcct-Unique-Session-Id = 'c7ef06b03b3786387596bf072db184d7'","offset":2733,"source":"/var/log/radius/radacct/10.122.217.4/detail-20170309","type":"log"} {"@timestamp":"2017-03-09T00:50:49.671Z","beat":{"hostname":"app.radius.local","name":"app.radius.local","version":"5.2.2"},"fields":{"type":"radiusdetail"},"input_type":"log","message":"\tTimestamp = 1489020648","offset":2757,"source":"/var/log/radius/radacct/10.122.217.4/detail-20170309","type":"log"}` ``` Below is my configuration file for filebeat ``` filebeat.prospectors: - input_type: log paths: - /var/log/radius/radacct/*/detail-* multiline.pattern: '^\t+.*$' multiline.negate: false multiline.match: after fields: type: radiusdetail output.file: path: "/tmp/filebeat" filename: filebeat ``` I really hope someone can help me with this! Lou ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [March 11, 2017, 5:55am UTC](https://discuss.elastic.co/t/understanding-multiline/77920/2 "2017-03-11T05:55:03Z")
The indentation is incorrect. The multiline options are members of the prospector config so they need to be at the same level as `input_type` and `paths`. ```auto filebeat.prospectors: - input_type: log paths: - /var/log/radius/radacct/*/detail-* multiline.pattern: '^\t+.*$' multiline.negate: false multiline.match: after document_type: radiusdetail # You might want this option instead of using fields. ``` ---
**Author:** ![Louuu](https://avatars.discourse-cdn.com/v4/letter/l/dbc845/32.png) [@Louuu](https://discuss.elastic.co/u/Louuu)\ **Post date:** [March 13, 2017, 4:20pm UTC](https://discuss.elastic.co/t/understanding-multiline/77920/3 "2017-03-13T16:20:30Z")
Hi Andrew, I shall give this a try in my test environment when I am next working on this project! Thank you! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 10, 2017, 4:20pm UTC](https://discuss.elastic.co/t/understanding-multiline/77920/4 "2017-04-10T16:20:34Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.