Configure multi line in logstash error with multi input file


(Trương Trang) #1

i configure file filebeat.yml like:
filebeat.prospectors:

  • paths:

    • "/var/log/payload"
      fields: {log_type: payload}
  • paths:

    • "/var/log/ont"
      fields: {log_type: ont}

    The regexp Pattern that has to be matched. The example pattern matches all lines starting with [

    multiline.pattern: '^[log]'

    Defines if the pattern set under pattern should be negated or not. Default is false.

    multiline.negate: true

    Match can be set to "after" or "before". It is used to define if lines should be append to a pattern

    that was (not) matched before or after or as long as a pattern is not matched based on negate.

    Note: After is the equivalent to previous and before is the equivalent to to next in Logstash

    multiline.match: after

but configure for multiline after [log] just apply for 1 file /var/log/ont and file payload it not send after [log] it send each line


(system) #2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.