After enabling multiline.pattern, filebeat service not starting


(Bhaskar Balapuram) #1

Hi Team,
There is requirement of shipping multiple lines of logs to elasticsearch. Here is the configuration which i placed in filebeat.yml file.

=============

  • type: docker
    combine_partial: true
    containers:
    path: "/var/lib/docker/containers"
    stream: "stdout"
    ids:
    - ""
    multiline.pattern: '.
    [.((\n.){50})'

    multiline.negate: false

    multiline.match: before

========================
After updating above configurations, filebeat service is not starting. Can you please advice to fix the issue.

Thanks in Advance.

Regards,
Bhaskar.


(Shaunak Kashyap) #2

Are you seeing any errors or warnings in the Filebeat logs after trying to restart it?