Configure FileBeat to combine all logs without multiline pattern

Elastic Stack Beats
1

I am using Filebeat 6.4.2, Logstash 6.3.1 and want to combine all logs files on the filebeat input path </var/log/application.log> . Logs don't have any specific pattern to start with or end with.

    filebeat.inputs:

    - type: log
      enabled: true
      paths:
        - /var/log/application.log
      fields:
        type: admin
        tags: admin
      fields_under_root: true

      multiline.pattern:  '.' 
      multiline.negate: true
      multiline.match: after
      multiline.max_lines: 1000

output.logstash:
  # The Logstash hosts
  hosts: ["xxx.20.x.xxx:5043"]

Note : Logs don't have any specific pattern. I want to capture all combined logs in Logstash together in bunch of max lines specified.

I tried with multiple RegEx in the pattern sections, it's not working. Problem is logs does'nt come in any specific pattern.

2

Hi @abhisekdg,

I wonder how big can this file get? A config like this should probably work (didn't test it):

multiline.pattern: .
multiline.match: after
multiline.negate: false
4

HI @exekias, I checked the multiline pattern configuration.
It not worked for me. Still all the logs are coming as separate document in logstash.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.