Please find the yaml files.
/etc/filebeat/filebeat.yml:::
filebeat.config:
inputs:
enabled: true
path: inputs.d/*yml
reload.enabled: true
reload.period: 10s
setup.template.settings:
index.number_of_shards: 1
/etc/filebeat/inputs.d/modulename.yml::::
- type: log
paths:
- /modulename.log
scan_frequency: 10s
fields:
service: modulename
env: dev
multiline.type: pattern
multiline.pattern: ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}.\d{3}
multiline.negate: true
multiline.match: after
close_inactive: 1m
close_removed: true
clean_removed: true
Can you please explain more on your comments about multiline never close. How can I check that?