Filebeat cut multiline on 500 line

Elastic Stack Beats
1

I use Filebeat to send logs to remote logstash.
I use multiline

- input_type: log
  paths:
    - /production_xml.log
  multiline.pattern: '^Response_id|^Request_id'
  multiline.negate: true
  multiline.match: after

My log about 900 lines and looks like:

Response_id: 20171016133116502015851
Response_time: 2017-10-16 13:31:16 +0500
Response_body: <?xml version="1.0" encoding="UTF-8"?>
<result>
  ...
    ~900lines
  ...
</result>

But I see first 500 lines in logstash. As result xml-paser writes in logs:

No close tag for /result/query_ns[11]

Why Filebeat cut on 500 line? is it possible to fix?

2

Also set multiline.max_lines: 1000. The default is 500 lines. The max_bytes setting also limits event sizes to 10MB by default.

3

This topic was automatically closed after 21 days. New replies are no longer allowed.