Add a separator character in multiline configuration

[zeenon]

hi,
I have a multiline configuration like this:
multiline.pattern : '^.{22}*'
multiline.negate: false
multiline.match: after

and filebeat joins the lines if a * is found at column 23
each original line has a \t to separate fields, so it would be nice if filebeat add a \t before joining lines
So, If a line has 10 \t separator, it is a concatenation of two lines; if a line has 15 \t separator; it is a concatenation of three lines and so on.
Is it possible ?

[steffens (Steffen Siering)]

Do you have some sample logs and output you want? Filebeat splits lines on \n or \r\n only. A custom split pattern for events is not yet configurable.

[zeenon]

For example,
2017/10/23 l1f1\tl1f2\l1f3
2017/10/23 *l2f1\tl2f2\l2f3

and driven by the star in column 12,
2017/10/23 l1f1\tl1f2\l1f3\t2017/10/23 *l2f1\tl2f2\l2f3

[steffens (Steffen Siering)]

If I understand you correctly, you want to replace * with \t. Filebeat still inserts the \n character. You will have to use logstash or elasticsearch ingest node to do additional processing to replace characters.