Fail to use multiline input mode in filebeats

I try to send a multiline event to logstash from xml file via filebeats. I use 7.5.2 version for both programs, and Windows 10.
My xml file is next:

my logstash configuration file is:

input {
port => 5044 }
output {stdout{codec => rubydebug }


I set the next attributes in filebeats.yml file:


  • type: log
    enabled: true
    paths: "C:\some_path\filebeat-7.5.0-windows-x86_64\xml\*"
    multiline.pattern: ^<note
    multiline.negate: true
    multiline.match: after
    hosts: ["localhost:5044"]

and still stdout prints 5 different events instead of one. I tried to send the file to logstash using input mode without using filebeats, but it didnt work at all. It is another issue but I mention this for case they are connected somehow.
Any idea what i do wrong?


Could you provide the Filebeat's output, so as to verify that there is nothing wrong there?


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.