Filebeat conditional multiline on container metadata

Elastic Stack Beats
1

Using a filebeat configuration:

filebeat.inputs:
  - type: container
    paths:
      - '/var/lib/docker/containers/*/*.log'
processors:
  - add_docker_metadata:
      host: "unix:///var/run/docker.sock"

How can I apply conditional multiline configuration based on some container metadata?
In docs I only found a mehtod to apply multiline to whole input, thus all container logs.
I'm searching for something like this:

filebeat.inputs:
  - type: container
    paths:
      - '/var/lib/docker/containers/*/*.log'
  processors:
    - add_docker_metadata:
        host: "unix:///var/run/docker.sock"
    - if:
        container.labels.app: java
      then:
        - multiline:
           pattern: '^[[:space:]]+(at|\\.{3})\\b|^Caused by:'
           negate: false
           match: after

but there is no multiline processor. Are there any other methods?

Initialy I was using the autodiscover feature and adding labels (co.elastic.logs/multiline.pattern) to containers in docker-compose.yml, but this feature is still in beta and I've seen some missing logs from containers.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.