Hello,
I am trying to parse a java log file using filebeat with multiline. The filebeat.yml
looks like this:
filebeat.prospectors:
- type: log
enabled: true
paths:
- /home/jetty/logs/*.log
tags: ["jetty"]
fields_under_root: true
fields:
service: jetty
multiline.pattern: ^[A-Z]{3} [0-9]{2}, [0-9]{4} [0-9]{2}:[0-9]{2}:[0-9]{2} [A,P]M
multiline.negate: true
multiline.match: after
multiline.flush_pattern: ^[A-Z]{3} [0-9]{2}, [0-9]{4} [0-9]{2}:[0-9]{2}:[0-9]{2} [A,P]M
in logstash I am getting everything in one message and files are not split up in different packets following the multiline.pattern rule. As in the following example:
Any suggestion?
Thanks in advance