# Why is multiline not working for this unstructured log?

**URL:** <https://discuss.elastic.co/t/why-is-multiline-not-working-for-this-unstructured-log/325510>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [February 14, 2023, 7:32pm UTC](https://discuss.elastic.co/t/why-is-multiline-not-working-for-this-unstructured-log/325510 "2023-02-14T19:32:18Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![erwin339](https://avatars.discourse-cdn.com/v4/letter/e/2bfe46/32.png) [@erwin339](https://discuss.elastic.co/u/erwin339)\
**Post date:** [February 14, 2023, 7:32pm UTC](https://discuss.elastic.co/t/why-is-multiline-not-working-for-this-unstructured-log/325510/1 "2023-02-14T19:32:18Z")

</div>

My multiline:

```auto
parsers:
 -multiline:
      type: pattern
      pattern: '^\{'
      negate: true
      match: after   

```

The format of my log can be like this:

```auto
{ C-FLOW-ID-CAB APN101MQ C-OPERATION-CAB P T-EVENTO-CAB RUNNING T-EXTERNAL-ID-CAB NULL F-MESSAGE-CAB 20221110 H-MESSAGE-CAB 600478 C-MESSAGE-ID-CAB DC62CCED0E5F6000 M-STATUS-CAB 02
}

```

and also:

```auto
{C-FLOW-ID-CAB APN101MQ C-OPERATION-CAB P T-EVENTO-CAB RUNNING T-EXTERNAL-ID-CAB NULL F-MESSAGE-CAB 20221110 H-MESSAGE-CAB 600478 C-MESSAGE-ID-CAB DC62CCED0E5F6000 M-STATUS-CAB 02 [
<FOTO><Status>RUNNING</Status><EVENTO>2022111006:00:47.3</EVENTO></FOTO>
]}

```

In the first example log that I put I get this (the closing of the bracket is not there):

 ![FirstExample.png](https://us1.discourse-cdn.com/elastic/original/3X/4/1/419e9a6908e1c2cb583d5693851057e90643e941.jpeg)  
In the second example log that I put I get this:  
 ![SecondExample.png](https://us1.discourse-cdn.com/elastic/original/3X/b/9/b98ee31d7445e7636baab7e082ef3c1afb4257a8.jpeg)  
 ![SecondExample2.png](https://us1.discourse-cdn.com/elastic/original/3X/5/4/5474bbd9b0a046ba9e7c8d3e7245297f936e31ef.jpeg)  
In this second example I get 2 errors, the first and most significant is that the log is separated into two parts and the other is the same as the closing bracket.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 14, 2023, 9:33pm UTC](https://discuss.elastic.co/t/why-is-multiline-not-working-for-this-unstructured-log/325510/2 "2023-03-14T21:33:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.