Filebeat 5.0 with multiline, split event data to two events

[andrewkroh]

@ori.rubinfeld

If it was a timeout, then I would expect to see many small events for each unrelated line from the stack trace

Good point.

So how about adding a file output so you can inspect the events generated by Filebeat and enabling debug logging. Then next time you get a stack trace event published to ES that is split across two events you can check what the event looked like in the file output and find the logs that correspond to when the stack trace was processed.