I am using Elasticsearch 5.3 with Filebeat to collect java system logs. I ship them directly to elasticsearch's ingest pipeline. I have filebeat set up to merge stacktraces into a single event, which I have verified is working correctly, however when I ship it to elastic, the message gets cut off after the first new line character. How can I resolve this?
Filebeat multiline processor:
For example, Filebeat will send this message:
[2017-04-12 19:02:44.990] [Emmas-MacBook-Pro.local] [main] ERROR o.s.boot.SpringApplication@reportFailure:839 - Application startup failed\norg.springframework.beans.factory.
And Elasticsearch will only save
"[2017-04-12 19:02:44.990] [Emmas-MacBook-Pro.local] [main] ERROR o.s.boot.SpringApplication@reportFailure:839 - Application startup failed"
In the message field