Error with multiline codec

Elastic Stack Beats
1

Below is my filebeat yml:

---
    filebeat.prospectors: 

     ## mxtiming_server.log ##
      - 
        document_type: timing_server.log
        paths: 
          - /appdir/logs/traces/timing_*_*_*.log

 ## launchermandatory ##
  - 
    document_type: launchermandatory.log
    paths: 
      - appdir/logs/*.launcher.site1.common.launchermandatory.log
        multiline:    
          pattern: "^%{TIMESTAMP_ISO8601}|^Start|^Process"
          negate: true
          match: "previous"
output.logstash: 
  hosts: 
    - "10.23.123.12:5044"

I encounter this error when trying to start filebeat.

2017/07/06 02:46:30.768030 beat.go:339: CRIT Exiting: error loading states for prospector 11305635189455336900: unknown matcher type: previous accessing 'filebeat.prospectors.1.multiline' (source:'/etc/filebeat/filebeat.yml')
Exiting: error loading states for prospector 11305635189455336900: unknown matcher type: previous accessing 'filebeat.prospectors.1.multiline' (source:'/etc/filebeat/filebeat.yml')

Can someone help me with this?

Is it my syntax?

Thanks

2

Ok i solved the error.
Stupid mistake by me.

match: before / after
not previous / next

1 Like
3

Glad you did! I marked your own answer as solution, others may benefit from it :slight_smile:

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.