Fail to use multiline input mode in filebeats

Elastic Stack Beats
1

I try to send a multiline event to logstash from xml file via filebeats. I use 7.5.2 version for both programs, and Windows 10.
My xml file is next:

image
my logstash configuration file is:

input {
beats{
port => 5044 }
}
output {stdout{codec => rubydebug }

}

I set the next attributes in filebeats.yml file:

filebeat.inputs:

  • type: log
    enabled: true
    paths: "C:\some_path\filebeat-7.5.0-windows-x86_64\xml\*"
    multiline.pattern: ^<note
    multiline.negate: true
    multiline.match: after
    output.logstash:
    hosts: ["localhost:5044"]

and still stdout prints 5 different events instead of one. I tried to send the file to logstash using input mode without using filebeats, but it didnt work at all. It is another issue but I mention this for case they are connected somehow.
Any idea what i do wrong?

2

Hi!

Could you provide the Filebeat's output, so as to verify that there is nothing wrong there?

Thanks!

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.