I have a problem with Filebeat (7.17) that when trying to read multiline Java Stacktrace logs, it works without problems when input.type: filestream but when running the same in our Kubernetes stack, as input.type: container then the multiline parser is not picked up.
My config:
filebeat.inputs:
- type: container
paths:
- /var/log/containers/*.log
parsers:
- multiline:
type: pattern
pattern: '^[[:space:]]+(at|\.{3})[[:space:]]+\b|^Caused by:'
negate: false
match: after
or is there another workaround to receive Java Stacktraces as single message entries in Elastic?
We are using K8S Filebeat pods > Elastic + Ingest Pipelines at the moment.