Filebeat error while parsing multiline parser config

Elastic Stack Beats
1

I am using Filebeat 8.7. I am trying to follow the instructions here:

I double checked the indentation. Cannot figure out what is wrong. I just want to make sure
a multi-line stack trace is captured into one document instead of one document indexed per line of the stack trace. I see there is an example for the stack trace but I want to make sure the simplest config is working before attempting a more complicated one.

This is the relevant portion of the filebeat.yml

filebeat.inputs:

# Each - is an input. Most options can be set at the input level, so
# you can use different inputs for various configurations.
# Below are the input specific configurations.

- type: filestream
  id: ams-api
  fields:
    app_id: ams-api
  paths:
    - /opt/amsdev/logs/ams-api-logs/ams-api.log
  parsers:
    - multiline:
      type: pattern
      pattern: '\\$'
      negate: false
      match: before

- type: filestream
  id: ams-cache-manager
  fields:
    app_id: ams-cache-manager
  paths:
    - /opt/amsdev/logs/ams-cache-manager-logs/ams-cache-manager.log

Error from journalctl:

Exiting: Failed to start crawler: starting input failed: error while initializing input: error while parsing multiline parser config: unknown matcher type: accessing 'filebeat.inputs.0.parsers.0.multiline' accessing 'filebeat.inputs.0' (source:'/etc/filebeat/filebeat.yml')","service.name":"filebeat","ecs.version":"1.6.0"

2

Hi @paolovalladolid

Nope, indentation is not correct...
The parser list starts a the same level of multiline
Type pattern, etc. Need to be indented from the multiline like the example in the docs you referenced.

  parsers:
  - multiline:
      type: pattern
      pattern: '\\$'
      negate: false
      match: before
1 Like
3

Thanks! Fixing the note indentation fixed the issue.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.