Filebeat multi-line pattern splitting events

Elastic Stack Beats
1

Hi Team

my logs looks like

2018-01-24 16:00:00,487 INFO (testAdapter.java:156) - IP Address : 192.168.0.7
2018-01-24 16:00:00,487 INFO (testAdapter.java:156) - eureka access successfull
2018-01-24 16:00:00,487 INFO (testAdapter.java:156) - eureka connected
2018-01-24 16:00:00,495 INFO (testAdapter.java:156) - connection successfull 121

Iam getting 2 events instead of one with file beat multiline pattern as shown below

multiline.pattern: 'IP Address'
multiline.negate: true
multiline.match: after
multiline.flush_pattern: 'connection successfull'

Kibana output

message:2018-01-24 16:00:00,487 INFO (testAdapter.java:156) - IP Address : 192.168.0.7
2018-01-24 16:00:00,487 INFO (testAdapter.java:156) - eureka access successfull
2018-01-24 16:00:00,487 INFO (testAdapter.java:156) - eureka connected

meaasage:2018-01-24 16:00:00,495 INFO (testAdapter.java:156) - connection successfull 121

2

What if you try this?

multiline.pattern: 'IP Address'
multiline.negate: true
multiline.match: after
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.