Hello,
I am trying to import some logs and configured it with an exclusion line and multiline.
If I configure just the exclusion its working for this but if I also configure multiline in addition it seems to be ignored as the lines which should be excluded were imported.
All is send to logstash.
Config:
filebeat.inputs:
- type: log
enabled: true
paths:
- C:/Logs/**
exclude_lines: ['^[*]+$']
multiline.pattern: ^Command start
multiline.negate: true
multiline.match: after
What I have:
**********************
Command start time: 20200416214821
**********************
**********************
Start time: 20200416214819
Username: WORKGROUP\SYSTEM
RunAs User: WORKGROUP\SYSTEM
**********************
True
**********************
**********************
Command start time: 20200416225643
**********************
**********************
Start time: 20200416225312
Username: WORKGROUP\SYSTEM
RunAs User: WORKGROUP\SYSTEM
**********************
False
**********************
What I try:
- all ********************** should be exluded (not working)
- From 'Command start' till the next should be one event (working)
Any idea whats wrong?
Best Regards