Filebeat merge lines when we do not need that


#1

Hi,

I have a strange problem with Filebeat, it combines lines.
In the below example the line with "TID ... DEBUG" is merged in one single line with the next which contain "TID...INFO"
In fact they are separate lines in the log file.

//2018-02-21T14:46:08+02:00 DBG Drop line as it does match one of the exclude patternsTID: [-1] [] [2018-02-21 14:46:07,241] DEBUG {org.apache.synapse.transport.http.heaJAdzBtMTc= {org.apache.synapse.transport.http.headers}
TID: [-1234] [] [2018-02-21 14:46:07,243] INFO {org.apache.synapse.mediators.builtin.LogMediator} - To: /services/Ji2W, WSAction: http://www.example.org/Ji2W/sWO, MessageID: urn:uuid:64ae393e-ac3a-4ae0-a259-10a079821557, Direction: request, st = start_log_info, flow = Ji2W, messageStep = 1, initiator = Jira, transactionT encoding='utf-8'?><env:Envelope xmlns:env="http://www.w3.org/2003/05/soap-envelope">env:Body<ns3:checkStatus xmlns:ns3="http://www.example.org/Ji2W/"> {org.apache.synapse.mediators.builtin.LogMediator}

And in filebeat.yml I have an exclude directive:
//exclude_lines: ['^(?m)TID.DEBUG.$','^(?m)TID.ERROR.$']
which drop also the INFO line.

Any ideas?

Thanks,
uvali


(system) #2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.