# Unexpected encoding line reader error when enabling multiline

**URL:** <https://discuss.elastic.co/t/unexpected-encoding-line-reader-error-when-enabling-multiline/43388>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 3, 2016, 1:27pm UTC](https://discuss.elastic.co/t/unexpected-encoding-line-reader-error-when-enabling-multiline/43388 "2016-03-03T13:27:11Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![martkuper](https://avatars.discourse-cdn.com/v4/letter/m/ac8455/32.png) [@martkuper](https://discuss.elastic.co/u/martkuper)\
**Post date:** [March 3, 2016, 1:27pm UTC](https://discuss.elastic.co/t/unexpected-encoding-line-reader-error-when-enabling-multiline/43388/1 "2016-03-03T13:27:11Z")

</div>

I've been trying to get Filebeat (v1.1.1 on centos7) to apply a multiline filter before outputting a java log (utf-8 encoded) into redis. The java log looks like this:

> 2016-03-03 09:47:13,690 INFO Wall-e-main Robot - done processing, sleeping for 10 seconds  
> 2016-03-03 09:47:19,101 INFO Wall-e-status ThreadedRobot - PoolSize: 18, ActiveCount: 0, QueueSize: 0  
> 2016-03-03 09:47:23,696 INFO Wall-e-main ThreadedRobot - selected 0 articles for processing  
> 2016-03-03 09:47:23,697 INFO Wall-e-main Robot - done processing, sleeping for 10 seconds  
> 2016-03-03 09:47:29,039 INFO Roy-main Robot - refreshWorker articleIdKey null  
> 2016-03-03 09:47:29,039 INFO Roy-main Robot - Return jedis connection to pool

There are also some java stack traces in there, which begin like this:

> 2016-03-03 09:46:52,562 ERROR Roy--Aggressive-worker-1 Dispatcher - RhinoException occurred while processing:

The filebeat config that i'm using is the following:

```
filebeat:
  prospectors:
    -
      paths:
        - /path/to/log
      input_type: log
      fields:
        logtype: robot
        environment: staging
      multiline:
        pattern: '^[[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2}' 
        negate: true
        what: after
          
output:
  redis:
    host: "1.2.3.4"
    port: 6379

```

With the multiline in place, I keep getting this error:

> log.go:135: ERR Stop Harvesting. Unexpected encoding line reader error: unknown matcher type:

When I comment the multiline out, the file processes just fine. I already tried converting the file from utf-8 to ascii, which didn't do anything. The odd part is that the syslog, secure log and cron log process just fine with a multiline filter applied.

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [March 3, 2016, 1:50pm UTC](https://discuss.elastic.co/t/unexpected-encoding-line-reader-error-when-enabling-multiline/43388/2 "2016-03-03T13:50:53Z")

</div>

You are using `what` instead of `match`. See [https://www.elastic.co/guide/en/beats/filebeat/current/configuration-filebeat-options.html#multiline](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-filebeat-options.html#multiline) This one is called differently then in LS.

---

<div class="post-metadata">

**Author:** ![martkuper](https://avatars.discourse-cdn.com/v4/letter/m/ac8455/32.png) [@martkuper](https://discuss.elastic.co/u/martkuper)\
**Post date:** [March 3, 2016, 1:59pm UTC](https://discuss.elastic.co/t/unexpected-encoding-line-reader-error-when-enabling-multiline/43388/3 "2016-03-03T13:59:33Z")

</div>

Thank you! I completely missed that. It works now

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 9:55pm UTC](https://discuss.elastic.co/t/unexpected-encoding-line-reader-error-when-enabling-multiline/43388/4 "2017-07-05T21:55:04Z")

</div>