If the string value contains line feeds then it's not valid JSON because all control characters must be escaped (see rfc 7151 section 7).
Filebeat (decode_json_fields) can handle pretty printed JSON where the object spans multiple lines, but it cannot handle this case where the string values contain control characters.
One possible solution is to do the multiline in Filebeat and the JSON decoding in Logstash. Prior to the JSON filter you could replace the line feeds with \n or \u000a.
Or you could modify the thing writing the logs to do JSON escaping.
Make sense. Thanks. Is there a way to pre-process messages in FileBeat to replace line break withs with '\n' without using LogStash? ( By using pipelines, etc)
Log message -> Replace line breaks with \n -> Decode Json -> Pretty print in Kibana.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.