After enabling multiline.pattern, filebeat service not starting

(Bhaskar Balapuram) #1

Hi Team,
There is requirement of shipping multiple lines of logs to elasticsearch. Here is the configuration which i placed in filebeat.yml file.


  • type: docker
    combine_partial: true
    path: "/var/lib/docker/containers"
    stream: "stdout"
    - ""
    multiline.pattern: '.

    multiline.negate: false

    multiline.match: before

After updating above configurations, filebeat service is not starting. Can you please advice to fix the issue.

Thanks in Advance.


(Shaunak Kashyap) #2

Are you seeing any errors or warnings in the Filebeat logs after trying to restart it?