Filebeat filestream input parsers multiline fails

Elastic Stack Beats
9

Hi @fgjensen
I've been struggling with this for days, I had the configuration as type: log on Filebeat 7.15 and I started over with version 7.16.2 and the type: filestream.
The documentation is definitely incomplete. It's an indentation issue.
The config that just two min ago worked for me is:

filebeat.inputs:
- type: filestream
  enabled: true
  paths:
    - /var/log/*.log
  parsers:
    - multiline:
        type: pattern
        pattern: '^\['
        negate: true
        match: after

Hope this could help someone else.
Cheers

2 Likes