title: Unable to push multiline events from Filebeat S3 input to Logstash
body: <p>I am doing a PoC on ELK and have come across an issue. I have had a look at many topics on discuss.elastic.co and StackOverflow, but none seems to have helped.</p>
  <p>I am trying to configure multiline events via Filebeat (using S3 input) and consuming them in Logstash. The issue that I am facing is that even after setting the multiline configuration in Filebeat, I still see the lines of a stacktrace as individual events in Logstash.</p>
  <p>Since Logstash receives the lines of the stacktrace not as a single event but as individual lines, it is leading to a _grokparsefailure at that end, which is completely understandable as FB should club those lines into the same event prior to sending them to Logstash.</p>
  <p>Other single line events are working expectedly and I am able to visualise them on Kibana.</p>
  <p>filebeat.yml:</p>
  <pre><code>filebeat.inputs:
  
    - type: s3
      queue_url: https://sqs.aaaaa.amazonaws.com/xxxxxxxx/zzzzzz
      visibility_timeout: 300s
      multiline.pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}'
      multiline.negate: true
      multiline.match: after
  </code></pre>
  <p>Logstash configuration:</p>
  <pre><code>input {
    beats {
      port =&gt; 5044
      host =&gt; &quot;0.0.0.0&quot;
    }
  }
  
  filter {
    grok {
      match =&gt; {&quot;message&quot; =&gt; &quot;%{TIMESTAMP_ISO8601:timestamp} %{GREEDYDATA:logType} %{LOGLEVEL:logLevel}%{SPACE}\[%{GREEDYDATA:key1}\] \[%{GREEDYDATA:key2}\] \[%{GREEDYDATA:key3}\] \[%{GREEDYDATA:sourceIP}\] %{GREEDYDATA:message}&quot;}
      overwrite =&gt; [ &quot;message&quot; ]
    } 
  
   date {
      match =&gt; [&quot;timestamp&quot;, &quot;yyyy-MM-dd HH:mm:ss,SSS&quot;]
    }
  }
  </code></pre>
  <p>Here are two sample log statements the second of which I am trying to combine into a single event:</p>
  <pre><code>2020-08-18 00:30:52,481 detailed_logs ERROR    [abc] [xyz] [def] [127.0.0.1] Exception raised. Trace:
  2020-08-18 00:30:52,483 detailed_logs ERROR    Traceback (most recent call last):
    File &quot;/Users/vvv/Documents/ttt.py&quot;, line 93, in get
      x = y.perform(abc)
    File &quot;/Users/vvv/Documents/ttt.py&quot;, line 283, in operate
      raise exception
    File &quot;/Users/vvv/Documents/ttt.py&quot;, line 169, in operate
      d[&quot;abb&quot;] = n[&quot;xy&quot;]
  AttributeError: 'model' object has no attribute 'create1d_on'
  </code></pre>
  <p>My gut tells me that it might be possible that Filebeat S3 input may not support multiline as I was not able to find a mention of the same in the <a href="https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-s3.html" rel="nofollow noreferrer">official doc</a>, whereas its <a href="https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-log.html#_multiline_3" rel="nofollow noreferrer">Log input counterpart</a> clearly mentions the same. But then again, I could be wrong.</p>
  <p>Would appreciate any nudge in the right direction.</p>