# Beats combining multi-line messages even after the multi-line pattern match **URL:** \ **Category:** Graylog Add-ons\ **Created:** [July 31, 2018, 12:54pm UTC](https://community.graylog.org/t/beats-combining-multi-line-messages-even-after-the-multi-line-pattern-match/6188 "2018-07-31T12:54:17Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![anmolsharma](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/anmolsharma/32/3456_2.png) [@anmolsharma](https://community.graylog.org/u/anmolsharma)\ **Post date:** [July 31, 2018, 12:54pm UTC](https://community.graylog.org/t/beats-combining-multi-line-messages-even-after-the-multi-line-pattern-match/6188/1 "2018-07-31T12:54:17Z")
collector sidecar version = 0.1.6 graylog version = 2.4.6 I am using beats input and enabled the multi-line support in collector sidecar as shown in the image below. This configuration was made using reference given in the link below. > **[Manage multiline messages | Filebeat Reference \[master\] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/master/multiline-examples.html)** ![Selection_307](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/8/80b4aeea590dbc3305c606c2bf16c9da13ef3676.png) The multi-line pattern is based on the line starting with the data format **YYYY/MM/DD**. This configuration is working as expected for combining the error messages span in multiple lines. **My Problem:** It is combining multiple log messages even when the line separator is present. Like as shown in the example image: ![Selection_308](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/d/dae145201b3d22d6d95186c31433901af219eb80.png) _Please help me in sorting out this thing._ Actually, multi-line was intended for the error log message samples like undermentioned: * * * > 2018/07/31 12:49:40 [error] 6010#0: \*4034 FastCGI sent in stderr: "y string to a string offset in /home/trainingbasketbreezeet3gi/public\_html/wp-content/plugins/ubermenu/includes/menuitems/UberMenuItem.class.php on line 569 > PHP message: PHP Warning: Illegal string offset ‘item\_display\_calc’ in /home/trainingbasketbreezeet3gi/public\_html/wp-content/plugins/ubermenu/includes/menuitems/UberMenuItem.class.php on line 679 > PHP message: PHP Warning: Illegal string offset ‘item\_display\_calc’ in /home/trainingbasketbreezeet3gi/public\_html/wp-content/plugins/ubermenu/includes/menuitems/UberMenuItem.class.php on line 569 * * * > 2018/07/31 12:13:24 [error] 6003#0: \*3025 FastCGI sent in stderr: “PHP message: PHP Fatal error: Uncaught Error: operator not supported for strings in /home/trainingbasketbreezeet3gi/public\_html/wp-content/plugins/revslider/includes/framework/base-admin.class.php:71 > Stack trace: > #0 /home/trainingbasketbreezeet3gi/public\_html/wp-content/plugins/revslider/admin/revslider-admin.class.php(572): RevSliderBaseAdmin::addMetaBox(‘Revolution Slid…’, ‘’, Array, NULL) > #1 /home/trainingbasketbreezeet3gi/public\_html/wp-content/plugins/revslider/admin/revslider-admin.class.php(73): RevSliderAdmin-\>addSliderMetaBox() > #2 /home/trainingbasketbreezeet3gi/public\_html/wp-content/plugins/revslider/admin/revslider-admin.class.php(44): RevSliderAdmin-\>init() > #3 /home/trainingbasketbreezeet3gi/public\_html/wp-content/plugins/revslider/revslider.php(165): RevSliderAdmin-\>\_\_construct(‘/home/trainingb…’) > #4 /home/trainingbasketbreezeet3gi/public\_html/wp-settings.php(305): include\_once(‘/home/trainingb…’) > #5 /home/trainingbasketbreezeet3gi/public\_html/wp-config.php(80): require\_once('/home” while reading response header from upstream, client: 122.162.66.236, server: [trainingbasketbreezeet3gi.breeze.io](http://trainingbasketbreezeet3gi.breeze.io), request: “GET /wp-admin/ HTTP/1.1”, upstream: “fastcgi://127.0.0.1:9000”, host: “[trainingbasketbreezeet3gi.breeze.io](http://trainingbasketbreezeet3gi.breeze.io)” ---
**Author:** ![anmolsharma](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/anmolsharma/32/3456_2.png) [@anmolsharma](https://community.graylog.org/u/anmolsharma)\ **Post date:** [August 1, 2018, 11:15am UTC](https://community.graylog.org/t/beats-combining-multi-line-messages-even-after-the-multi-line-pattern-match/6188/2 "2018-08-01T11:15:43Z")
Found the solution on the thread link undermentioned: > [@Collectors "Start pattern of multiline" Regular](https://community.graylog.org/t/collectors-start-pattern-of-multiline-regular/792): > > Hi, I have question at Collectors “Start pattern of multiline” , when I set one Regular match it work fine. But if I set two match string or whatever, it’s not work fine. Examples: 2017-04-11 or 2017/04/11 I set the regular is like: /^\d{4}-\d{2}/ =~ /^\d{4}/\d{2}/\d{2}/ or /^\d{4}-\d{2}/ | /^\d{4}/\d{2}/\d{2}/ How do I set this regular ? I have changed the multiline pattern as below: **^\d{4}/\d{2}/\d{2}** ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [August 15, 2018, 11:15am UTC](https://community.graylog.org/t/beats-combining-multi-line-messages-even-after-the-multi-line-pattern-match/6188/3 "2018-08-15T11:15:50Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.