Cannot get multiline config correct in 6.5.1

Elastic Stack Beats
1

I have tried to install 6.5.1 on a windows machine, before I was running 6.1.2. Everything has gone alright except the multiline config for my filebeat (6.5.1 win_x86).

I tried using the "same" config (there are some minor differences (eg. filebeat.prospectors => filebeat.inputs). But I cannot get the multililne config to parse correctly and I don't understand why. Do any of you understand? What have I missed?

  # Optional additional fields. These field can be freely picked
  # to add additional information to the crawled log files
  fields:
    log_type: strslog_application

  # Multiline
  multiline.pattern: '^([0-9]{4} [0-9]{6})'
  multiline.negate: true
  multiline.match: after​

File is in UTF-8 with unix line feed (LF). Everything works fine when removing the multiline config.

Error message is:

2018-12-13T08:43:39.709+0100    ERROR   instance/beat.go:800    Exiting: Error in initing input: unknown matcher type: a
fter​ accessing 'filebeat.inputs.0.multiline' (source:'filebeat.yml')
Exiting: Error in initing input: unknown matcher type: after​ accessing 'filebeat.inputs.0.multiline' (source:'filebeat.
yml')
2

Solved! This one one of the harder things to find out.

Finally I figured out that there was some hidden bytes in the file that you could only see in a hex editor.

image

Look at the four (4) last bytes 72 e2 80 8b.
72 is r but e2 80 8b does not match any characters in the ASCII-table. See eg. https://www.ibm.com/support/knowledgecenter/en/ssw_aix_72/com.ibm.aix.networkcomm/conversion_table.htm

So by removing those bytes it now works!

Note: that these bytes were also present in the question above

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.