i configure file filebeat.yml like:
filebeat.prospectors:
-
paths:
- "/var/log/payload"
fields: {log_type: payload}
- "/var/log/payload"
-
paths:
- "/var/log/ont"
fields: {log_type: ont}
The regexp Pattern that has to be matched. The example pattern matches all lines starting with [
multiline.pattern: '^[log]'
Defines if the pattern set under pattern should be negated or not. Default is false.
multiline.negate: true
Match can be set to "after" or "before". It is used to define if lines should be append to a pattern
that was (not) matched before or after or as long as a pattern is not matched based on negate.
Note: After is the equivalent to previous and before is the equivalent to to next in Logstash
multiline.match: after
- "/var/log/ont"
but configure for multiline after [log] just apply for 1 file /var/log/ont and file payload it not send after [log] it send each line