Filebeat doesn't send updated logs

[Sergey_Ivanov1 (Sergey Ivanov)]

Good day!
Have a problem, my filebeat, wich is installed in Windows doesn't send updated logs. After restart the service, filebeat send all the data from the file, and that is it. After some time I can see that the log file is updated , but no logs in logstash.
the config is:

filebeat.inputs:
- type: filestream
  id: cr001
   enabled: true
  paths:
    - c:\...\*.log
  ignore_older: 24h
  parsers:
  - multiline:
      type: pattern
      pattern: '^(Caused by:)|^\t(at .*)$|^\t\.\.\.'  # Matches lines starting with "Caused by:", "\t(at .*)", or "\t..."
      negate: false     # Do NOT negate the pattern (match lines that start with the specified patterns)
      match: after      # Combine lines that do not match the pattern with the previous line
      max_lines: 1000   # Maximum number of lines to combine
  exclude_lines: ['^.{0,5}g.{0,5}$', '^$']

and the log:
"message":"Non-zero metrics in the last 30s"

Pls support, have tried many options like close_inactive close_timout, but still
no success.

[stephenb (Stephen Brown)]

Hi @Sergey_Ivanov1 Welcome to the community.

@Sergey_Ivanov1

  - multiline:
      type: pattern
      pattern: '^(Caused by:)|^\t(at .*)$|^\t\.\.\.'  # Matches lines starting with "Caused by:", "\t(at .*)", or "\t..."
      negate: false     # Do NOT negate the pattern (match lines that start with the specified patterns)
      match: after      # Combine lines that do not match the pattern with the previous line
      max_lines: 1000   # Maximum number of lines to combine
  exclude_lines: ['^.{0,5}g.{0,5}$', '^$']

If you take all that out... do new lines show up? Even if incorrect?

Also, how fast do new lines come? When sent to the logstash, they may be queued depending on your output configuration, which you did not share.

Are the new lines part of the multi-line?