Filebeat 5.0 with multiline, split event data to two events

[ori.rubinfeld]

Hi,

Still did not reproduce.....

Can it be related to:

Filebeat multiline ignores line if the newline doesn't exist

Thanks for the reply yes, i understand, but i keeping pushing the timeout and if there is no new event, the last even will be hidden for a unknown time i would suggest adding a optional preference for line_reader_timeout (disable by default), so after that time the line reader would push to the multiline the partial line it would already have. This would not be used for most people, but would allow one to fix this kind of problems on logs with small number of events Another alternative would …

Maybe the stack trace is being written partially, and by the timeout, the Filebeat sends a first part of it, and when the stack trace finished the writing, and Filebeat sends the rest????? Maybe Filebeat knows it is in the middle of a multiline event, so it sends all the lines together????

Ori