Filebeat multiline config problem


(9AutumnRain) #1

hey guys:
I have logs format like this:

*****************
line a
line b
*****************
line c
line d
*****************
line e
line f

and I want to combine the lines bewteen "***" lines and exclude "***" lines themself,like this:

"line a
line b"

"line c
line d"

"line e
line f"

how should I configure filebeat? thanks.


(Tudor Golubenco) #2

You can combine them together with something like this:

multiline.pattern: '****'
multiline.negate: true
multiline.match: after

But that's going to include the "****" lines. You can, however, post-process the messages in the Elasticsearch Ingest Node or Logstash to remove the **** line.


(9AutumnRain) #3

Thank you.I successfully tried remove them with Logstash.


(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.