Filebeat multiline does't work

Elastic Stack Beats
,
1

Hello I have log files which looks like following:

Error Date:
7/4/2022 1:58:02 PM
Error Number: -2146823266
Line: 7
Line Code: if(!(Me.Context.getXPath("is-empty(kmFundsAccounting.fTotalAmount)") || Me.Context.getXPath("is-empty(kmFundsAccounting.kpCurrency)"))){
Error Message:
Attribute kmFundsAccounting not found in the Scope chain 

Rule:
var m_attributes = new CRuleAttributeHashTable(Me);
;var m___ = null;
//_11:Variables Declaration

//__11
//_1:Expression
if(!(Me.Context.getXPath("is-empty(kmFundsAccounting.fTotalAmount)") || Me.Context.getXPath("is-empty(kmFundsAccounting.kpCurrency)"))){
	if(Me.Context.getXPath("is-empty(kmFundsAccounting.kxBookings)") || Me.Context.getXPath("count(kmFundsAccounting.kxBookings[bIsTVA != true])") == 0){

		if(m_attributes["is-not-empty(kmDebitAccount)"]){
			var bookings = CHelper.GetValueAsCollection(Me.Context.getXPath("kmFundsAccounting.kxBookings[kmDebitAccount IS NULL]"));
			for(var i = 0; i < bookings.size(); i++){
				bookings.get(i).setXPath("kmDebitAccount", m_attributes["kmDebitAccount.id"]);
			}


			var segments = CHelper.GetValueAsCollection(m_attributes["kmDebitAccount.kxDPFISegments"]);
			if(segments.size() > 0){
				if(m_attributes["is-empty(kmFundsAccounting.kpInvoiceSplitting)"]){
					m_attributes["kmFundsAccounting.kpInvoiceSplitting"] = CHelper.getEntityAttrib("P_InvoiceSplitting","idP_InvoiceSplitting"," sCode = '01' ");
				}

				for(var i=0;i < segments.size(); i++){
					if(segments.get(i).getXPath("count(kmDebitAccount.kxOtherRules[bNeverCharge = true AND bListInBookings != true])") < 1){
						var booking = Me.Context.newCollectionItem("kmFundsAccounting.kxBookings");
						booking.setXPath("kmDebitAccount", segments.get(i).getXPath("kmDebitAccount.id"));
						booking.setXPath("kpCurrency", m_attributes["kmFundsAccounting.kpCurrency.id"]);
						booking.setXPath("kmRecipientAccountSupplier", m_attributes["kmFundsAccounting.kmSupplierAccount.id"]);

						if(m_attributes["is-not-empty(kmFundsAccounting.fTotalAmount)"]){
							switch(m_attributes["kmFundsAccounting.kpInvoiceSplitting.sCode"]){
								case '01': booking.setXPath("fTotalAmount", CHelper.Math.Round((m_attributes["kmFundsAccounting.fTotalAmount"] / segments.size()), 2));  break;
								case '02': break;
								case '03': booking.setXPath("fTotalAmount", CHelper.Math.Round((m_attributes["kmFundsAccounting.fTotalAmount"] / segments.size()),2)); booking.setXPath("fIndividualSplitting", 100 / segments.size());  break;
							}
						}
					}
				}

			} else {
				var booking = Me.Context.newCollectionItem("kmFundsAccounting.kxBookings");
				booking.setXPath("kmDebitAccount", m_attributes["kmDebitAccount.id"]);
				booking.setXPath("fTotalAmount", m_attributes["kmFundsAccounting.fTotalAmount"]);
				booking.setXPath("kpCurrency", m_attributes["kmFundsAccounting.kpCurrency.id"]);
				booking.setXPath("kmRecipientAccountSupplier", m_attributes["kmFundsAccounting.kmSupplierAccount"]);
			}
			if((m_attributes["bInvolvedHAFS"] || m_attributes["kpTVAOption.sCode"] == "005"|| (m_attributes["kpTVAOption.sCode"] == "002" && m_attributes["exists(kmFundsAccounting.kxBookings[kmDebitAccount.bInterimAccount != true AND kmDebitAccount.bIsUmbrellaFunds != true AND kmDebitAccount.bIsSegmentFunds != true AND bIsTVA != true].kmDebitAccount.kxOtherRules[bTVAReverseCharge = true])"])) && m_attributes["is-not-empty(fTotalAmount)"] && m_attributes["is-not-empty(kpCurrency)"]){
				bookings = CHelper.GetValueAsCollection(Me.Context.getXPath("kmFundsAccounting.kxBookings[kmDebitAccount.bInterimAccount != true AND kmDebitAccount.bIsUmbrellaFunds != true AND kmDebitAccount.bIsSegmentFunds != true AND bIsTVA != true]"));
				var TVAInterim = false;
				for(var i = 0; i < bookings.size(); i++){
					var booking = bookings.get(i).getXPath("kmTVABooking")
					if(booking == null)
						booking = Me.Context.newCollectionItem("kmFundsAccounting.kxBookings");
					booking.setXPath("kmDebitAccount", bookings.get(i).getXPath("kmDebitAccount.id"));
					booking.setXPath("kpCurrency", bookings.get(i).getXPath("kpCurrency.id"));
					booking.setXPath("kpAmountType", bookings.get(i).getXPath("kpAmountType.id"));
					booking.setXPath("kpBookingStatus", bookings.get(i).getXPath("kpBookingStatus.id"));
					booking.setXPath("fTotalAmount", (bookings.get(i).getXPath("fTotalAmount") / m_attributes["kmFundsAccounting.fTotalAmount"]) * m_attributes["fTotalAmount"]);
					booking.setXPath("bIsTVA", true);
					if(m_attributes["kpTVAOption.sCode"] == "005"){
						booking.setXPath("sReference", CHelper.getEntityAttrib("P_DPFI_Parameter","sValue"," sCode = '12' "));
						//booking.setXPath("sReference2", m_attributes["kmSupplier.sName"] + " " + m_attributes["sInvoiceNumber"]);
					}  else if(m_attributes["kpTVAOption.sCode"] == "002"){
						booking.setXPath("sReference", bookings.get(i).getXPath("kmDebitAccount.kxOtherRules[bTVAReverseCharge = true].sTVAReference"));
						booking.setXPath("sReference2", m_attributes["kmSupplier.sName"] + " " + m_attributes["sInvoiceNumber"]);
					} else {
						booking.setXPath("sReference", CHelper.getEntityAttrib("P_DPFI_Parameter","sValue"," sCode = '11' "));
					}
					if(Me.Context.getXPath("count(kmFundsAccounting.kxBookings[kmDebitAccount.bInterimAccount = true AND bIsTVA != true])") > 0){
						var account = CHelper.GetValueAsCollection(Me.Context.getXPath("kmFundsAccounting.kxBookings[kmDebitAccount.bInterimAccount = true AND bIsTVA != true]"));
						if((Me.Context.getXPath("count(kmFundsAccounting.kxBookings[kmDebitAccount.bInterimAccount = true AND bIsTVA = true])") == 0) && !TVAInterim){
							var TVABooking = Me.Context.newCollectionItem("kmFundsAccounting.kxBookings");
							TVABooking.setXPath("kmDebitAccount", account.get(0).getXPath("kmDebitAccount.id"));
							TVABooking.setXPath("kpCurrency", m_attributes["kpCurrency.id"]);
							TVABooking.setXPath("kpAmountType", bookings.get(i).getXPath("kpAmountType.id"));
							TVABooking.setXPath("kpBookingStatus", bookings.get(i).getXPath("kpBookingStatus.id"));
							TVABooking.setXPath("fTotalAmount", m_attributes["fTotalAmount"]);
							TVABooking.setXPath("bIsTVA", true);
							if(m_attributes["kpTVAOption.sCode"] == "005"){
								TVABooking.setXPath("sReference", CHelper.getEntityAttrib("P_DPFI_Parameter","sValue"," sCode = '12' "));
								//TVABooking.setXPath("sReference2", m_attributes["kmSupplier.sName"] + " " + m_attributes["sInvoiceNumber"]);
							}  else if(m_attributes["kpTVAOption.sCode"] == "002"){
								TVABooking.setXPath("sReference", bookings.get(i).getXPath("kmDebitAccount.kxOtherRules[bTVAReverseCharge = true].sTVAReference"));
								TVABooking.setXPath("sReference2", m_attributes["kmSupplier.sName"] + " " + m_attributes["sInvoiceNumber"]);
							} else {
								TVABooking.setXPath("sReference", CHelper.getEntityAttrib("P_DPFI_Parameter","sValue"," sCode = '11' "));
							}
							TVAInterim = true;
							var accountNumber = null;
							if(m_attributes["kpTVAOption.sCode"] == "005")
								accountNumber = CHelper.getEntityAttrib("P_DPFI_Parameter","sValue"," sCode = '10' ");
							else if(m_attributes["kpTVAOption.sCode"] == "002")
								accountNumber = bookings.get(i).getXPath("kmDebitAccount.kxOtherRules[bTVAReverseCharge = true].sTVARecipientAccount");
							else
								accountNumber = CHelper.getEntityAttrib("P_DPFI_Parameter","sValue"," sCode = '07' ");
							accountNumber = accountNumber.Replace("[Currency]", Me.Context.getXPath("is-not-empty(kpCurrency.sCode)")?Me.Context.getXPath("kpCurrency.sCode"):"");
							var parameters = new FilterParameters();
							parameters.AddParameter("@AccountNumber", accountNumber);
							var accountTVA = Me.getXPath("entity-list('M_SupplierAccount','sAccountNumber = @AccountNumber')",parameters);
							if(accountTVA.size() > 0)
								TVABooking.setXPath("kmRecipientAccountSupplier", accountTVA.get(0).getXPath("id"));
						}
						if(account.size() > 0){
							var accountNumber = account.get(0).getXPath("kmDebitAccount.sAccount");
							var recipientAccount = Me.getXPath("entity-list('M_SupplierAccount','sAccountNumber LIKE \"%"+accountNumber+"%"+m_attributes["kmFundsAccounting.kpCurrency.sCode"]+"%\"')");
							if(recipientAccount.size() > 0){
								booking.setXPath("kmRecipientAccountSupplier", recipientAccount.get(0).getXPath("id"));
							} else {
								recipientAccount = Me.getXPath("entity-list('M_SupplierAccount','sAccountNumber LIKE \"%"+accountNumber+"%\"')");
								if(recipientAccount.size() > 0)
									booking.setXPath("kmRecipientAccountSupplier", recipientAccount.get(0).getXPath("id"));
							}

						}

					} else {
						var accountNumber = null;
						if(m_attributes["kpTVAOption.sCode"] == "005")
							accountNumber = CHelper.getEntityAttrib("P_DPFI_Parameter","sValue"," sCode = '10' ");
						else if(m_attributes["kpTVAOption.sCode"] == "002")
							accountNumber = bookings.get(i).getXPath("kmDebitAccount.kxOtherRules[bTVAReverseCharge = true].sTVARecipientAccount");
						else
							accountNumber = CHelper.getEntityAttrib("P_DPFI_Parameter","sValue"," sCode = '07' ");
						accountNumber = accountNumber.Replace("[Currency]", Me.Context.getXPath("is-not-empty(kpCurrency.sCode)")?Me.Context.getXPath("kpCurrency.sCode"):"");
						var parameters = new FilterParameters();
						parameters.AddParameter("@AccountNumber", accountNumber);
						var account = Me.getXPath("entity-list('M_SupplierAccount','sAccountNumber = @AccountNumber')",parameters);
						if(account.size() > 0)
							booking.setXPath("kmRecipientAccountSupplier", account.get(0).getXPath("id"));
					}

					bookings.get(i).setXPath("kmTVABooking", booking.getXPath("id"));
				}
			}
		}
	} else {

		if((m_attributes["bInvolvedHAFS"] || m_attributes["kpTVAOption.sCode"] == "005"|| (m_attributes["kpTVAOption.sCode"] == "002" && m_attributes["exists(kmFundsAccounting.kxBookings[kmDebitAccount.bInterimAccount != true AND kmDebitAccount.bIsUmbrellaFunds != true AND kmDebitAccount.bIsSegmentFunds != true AND bIsTVA != true].kmDebitAccount.kxOtherRules[bTVAReverseCharge = true])"])) && m_attributes["is-not-empty(fTotalAmount)"] && m_attributes["is-not-empty(kpCurrency)"]){
			bookings = CHelper.GetValueAsCollection(Me.Context.getXPath("kmFundsAccounting.kxBookings[kmDebitAccount.bInterimAccount != true AND kmDebitAccount.bIsUmbrellaFunds != true AND kmDebitAccount.bIsSegmentFunds != true AND bIsTVA != true]"));
			var TVAInterim = false;
			for(var i = 0; i < bookings.size(); i++){
				var booking = bookings.get(i).getXPath("kmTVABooking")
				if(booking == null)
					booking = Me.Context.newCollectionItem("kmFundsAccounting.kxBookings");
				booking.setXPath("kmDebitAccount", bookings.get(i).getXPath("kmDebitAccount.id"));
				booking.setXPath("kpCurrency", bookings.get(i).getXPath("kpCurrency.id"));
				booking.setXPath("kpAmountType", bookings.get(i).getXPath("kpAmountType.id"));
				booking.setXPath("kpBookingStatus", bookings.get(i).getXPath("kpBookingStatus.id"));
				booking.setXPath("fTotalAmount", (bookings.get(i).getXPath("fTotalAmount") / m_attributes["kmFundsAccounting.fTotalAmount"]) * m_attributes["fTotalAmount"]);
				booking.setXPath("bIsTVA", true);
				if(m_attributes["kpTVAOption.sCode"] == "005"){
					booking.setXPath("sReference", CHelper.getEntityAttrib("P_DPFI_Parameter","sValue"," sCode = '12' "));
					//booking.setXPath("sReference2", m_attributes["kmSupplier.sName"] + " " + m_attributes["sInvoiceNumber"]);
				}  else if(m_attributes["kpTVAOption.sCode"] == "002"){
					booking.setXPath("sReference", bookings.get(i).getXPath("kmDebitAccount.kxOtherRules[bTVAReverseCharge = true].sTVAReference"));
					booking.setXPath("sReference2", m_attributes["kmSupplier.sName"] + " " + m_attributes["sInvoiceNumber"]);
				} else {
					booking.setXPath("sReference", CHelper.getEntityAttrib("P_DPFI_Parameter","sValue"," sCode = '11' "));
				}
				if(Me.Context.getXPath("count(kmFundsAccounting.kxBookings[kmDebitAccount.bInterimAccount = true AND bIsTVA != true])") > 0){
					var account = CHelper.GetValueAsCollection(Me.Context.getXPath("kmFundsAccounting.kxBookings[kmDebitAccount.bInterimAccount = true AND bIsTVA != true]"));
					if((Me.Context.getXPath("count(kmFundsAccounting.kxBookings[kmDebitAccount.bInterimAccount = true AND bIsTVA = true])") == 0) && !TVAInterim){
						var TVABooking = Me.Context.newCollectionItem("kmFundsAccounting.kxBookings");
						TVABooking.setXPath("kmDebitAccount", account.get(0).getXPath("kmDebitAccount.id"));
						TVABooking.setXPath("kpCurrency", m_attributes["kpCurrency.id"]);
						TVABooking.setXPath("kpAmountType", bookings.get(i).getXPath("kpAmountType.id"));
						TVABooking.setXPath("kpBookingStatus", bookings.get(i).getXPath("kpBookingStatus.id"));
						TVABooking.setXPath("fTotalAmount", m_attributes["fTotalAmount"]);
						TVABooking.setXPath("bIsTVA", true);
						if(m_attributes["kpTVAOption.sCode"] == "005"){
							TVABooking.setXPath("sReference", CHelper.getEntityAttrib("P_DPFI_Parameter","sValue"," sCode = '12' "));
							//TVABooking.setXPath("sReference2", m_attributes["kmSupplier.sName"] + " " + m_attributes["sInvoiceNumber"]);
						}  else if(m_attributes["kpTVAOption.sCode"] == "002"){
							TVABooking.setXPath("sReference", bookings.get(i).getXPath("kmDebitAccount.kxOtherRules[bTVAReverseCharge = true].sTVAReference"));
							TVABooking.setXPath("sReference2", m_attributes["kmSupplier.sName"] + " " + m_attributes["sInvoiceNumber"]);
						} else {
							TVABooking.setXPath("sReference", CHelper.getEntityAttrib("P_DPFI_Parameter","sValue"," sCode = '11' "));
						}
						TVAInterim = true;
						var accountNumber = null;
						if(m_attributes["kpTVAOption.sCode"] == "005")
							accountNumber = CHelper.getEntityAttrib("P_DPFI_Parameter","sValue"," sCode = '10' ");
						else if(m_attributes["kpTVAOption.sCode"] == "002")
							accountNumber = bookings.get(i).getXPath("kmDebitAccount.kxOtherRules[bTVAReverseCharge = true].sTVARecipientAccount");
						else
							accountNumber = CHelper.getEntityAttrib("P_DPFI_Parameter","sValue"," sCode = '07' ");
						accountNumber = accountNumber.Replace("[Currency]", Me.Context.getXPath("is-not-empty(kpCurrency.sCode)")?Me.Context.getXPath("kpCurrency.sCode"):"");
						var parameters = new FilterParameters();
						parameters.AddParameter("@AccountNumber", accountNumber);
						var accountTVA = Me.getXPath("entity-list('M_SupplierAccount','sAccountNumber = @AccountNumber')",parameters);
						if(accountTVA.size() > 0)
							TVABooking.setXPath("kmRecipientAccountSupplier", accountTVA.get(0).getXPath("id"));
					}
					if(account.size() > 0){
						var accountNumber = account.get(0).getXPath("kmDebitAccount.sAccount");
						var parameters = new FilterParameters();
						parameters.AddParameter("@AccountNumber", accountNumber);
						var recipientAccount = Me.getXPath("entity-list('M_SupplierAccount','sAccountNumber LIKE \"%"+accountNumber+"%"+m_attributes["kmFundsAccounting.kpCurrency.sCode"]+"%\"')");
						if(recipientAccount.size() > 0){
							booking.setXPath("kmRecipientAccountSupplier", recipientAccount.get(0).getXPath("id"));
						} else {
							recipientAccount = Me.getXPath("entity-list('M_SupplierAccount','sAccountNumber LIKE \"%"+accountNumber+"%\"')");
							if(recipientAccount.size() > 0)
								booking.setXPath("kmRecipientAccountSupplier", recipientAccount.get(0).getXPath("id"));
						}
					}

				} else {
					var accountNumber = null;
						if(m_attributes["kpTVAOption.sCode"] == "005")
							accountNumber = CHelper.getEntityAttrib("P_DPFI_Parameter","sValue"," sCode = '10' ");
						else if(m_attributes["kpTVAOption.sCode"] == "002")
							accountNumber = bookings.get(i).getXPath("kmDebitAccount.kxOtherRules[bTVAReverseCharge = true].sTVARecipientAccount");
						else
							accountNumber = CHelper.getEntityAttrib("P_DPFI_Parameter","sValue"," sCode = '07' ");
					accountNumber = accountNumber.Replace("[Currency]", Me.Context.getXPath("is-not-empty(kpCurrency.sCode)")?Me.Context.getXPath("kpCurrency.sCode"):"");
					var parameters = new FilterParameters();
					parameters.AddParameter("@AccountNumber", accountNumber);
					var account = Me.getXPath("entity-list('M_SupplierAccount','sAccountNumber = @AccountNumber')",parameters);
					if(account.size() > 0)
						booking.setXPath("kmRecipientAccountSupplier", account.get(0).getXPath("id"));
				}

				bookings.get(i).setXPath("kmTVABooking", booking.getXPath("id"));
			}
		}

		var bookings = CHelper.GetValueAsCollection(Me.Context.getXPath("kmFundsAccounting.kxBookings[kmDebitAccount.bInterimAccount != true AND bIsTVA != true]"));

		for(var i = 0; i < bookings.size(); i++){
			if(m_attributes["is-not-empty(kmFundsAccounting.fTotalAmount)"]){
				switch(m_attributes["kmFundsAccounting.kpInvoiceSplitting.sCode"]){
					case '01': bookings.get(i).setXPath("fTotalAmount", CHelper.Math.Round((m_attributes["kmFundsAccounting.fTotalAmount"] / bookings.size()), 2)); bookings.get(i).setXPath("fIndividualSplitting", bookings.get(i).getXPath("fTotalAmount") / m_attributes["kmFundsAccounting.fTotalAmount"] * 100);  break;
					case '02': break;
					case '03': /*bookings.get(i).setXPath("fTotalAmount", CHelper.Math.Round((m_attributes["kmFundsAccounting.fTotalAmount"] / bookings.size()), 2)); bookings.get(i).setXPath("fIndividualSplitting", 100 / bookings.size());*/  break;
				}
			}
		}


		bookings = CHelper.GetValueAsCollection(Me.Context.getXPath("kmFundsAccounting.kxBookings[kmDebitAccount.bInterimAccount != true AND bIsTVA = true]"));

		for(var i = 0; i < bookings.size(); i++){
			if(Me.Context.getXPath("count(kmFundsAccounting.kxBookings[kmTVABooking.id = " + bookings.get(i).getXPath("id") + "])") < 1){
				Me.Context.deleteCollectionItem("kmFundsAccounting.kxBookings",Me.Context.getXPath("kmFundsAccounting.kxBookings[id = "+bookings.get(i).getXPath("id")+"]"));
				continue;
			} else {
				bookings.get(i).setXPath("fTotalAmount", CHelper.Math.Round((Me.Context.getXPath("kmFundsAccounting.kxBookings[kmTVABooking.id = " + bookings.get(i).getXPath("id") + "].fTotalAmount") / Me.Context.getXPath("kmFundsAccounting.fTotalAmount")) * m_attributes["fTotalAmount"], 2));
			}
		}

		bookings = CHelper.GetValueAsCollection(Me.Context.getXPath("kmFundsAccounting.kxBookings[kmDebitAccount.bInterimAccount != true]"));
		var totalAmount = m_attributes["kmFundsAccounting.fTotalAmount"];
		var totalAmountSum = m_attributes["sum(kmFundsAccounting.kxBookings[kmDebitAccount.bInterimAccount != true && bIsTVA != true].fTotalAmount)"];
		var totalAmountSumTVA = m_attributes["sum(kmFundsAccounting.kxBookings[kmDebitAccount.bInterimAccount != true && bIsTVA == true].fTotalAmount)"];
		var totalAmountTVA = m_attributes["fTotalAmount"];
		CHelper.trace(Me.Case.CaseNumber, "TVA sum: " + totalAmountSumTVA + " | TVA: " + totalAmountTVA);

		for(var i = 0; i < bookings.size(); i++){
			if((!(bookings.get(i).getXPath("kmDebitAccount.bIsUmbrellaFunds") || bookings.get(i).getXPath("kmDebitAccount.bIsSegmentFunds"))) && m_attributes["kmFundsAccounting.kpInvoiceSplitting.sCode"] == '01' && bookings.get(i).getXPath("bIsTVA") != true){
				if(CHelper.Math.Round(totalAmountSum, 2) > CHelper.Math.Round(totalAmount, 2)){
					bookings.get(i).setXPath("fTotalAmount", bookings.get(i).getXPath("fTotalAmount") - 0.01);
					totalAmountSum = totalAmountSum - 0.01;
				} else if(CHelper.Math.Round(totalAmountSum, 2) < CHelper.Math.Round(totalAmount, 2)){
					bookings.get(i).setXPath("fTotalAmount", bookings.get(i).getXPath("fTotalAmount") + 0.01);
					totalAmountSum = totalAmountSum + 0.01;
				}
			} else if (bookings.get(i).getXPath("bIsTVA") == true){
				CHelper.trace(Me.Case.CaseNumber, "TVA sum: " + totalAmountSumTVA + " | TVA: " + totalAmountTVA);
				if(CHelper.Math.Round(totalAmountSumTVA,2) > CHelper.Math.Round(totalAmountTVA,2)){
					bookings.get(i).setXPath("fTotalAmount", bookings.get(i).getXPath("fTotalAmount") - 0.01);
					totalAmountSumTVA = totalAmountSumTVA - 0.01;
				} else if(CHelper.Math.Round(totalAmountSumTVA,2) < CHelper.Math.Round(totalAmountTVA,2)){
					bookings.get(i).setXPath("fTotalAmount", bookings.get(i).getXPath("fTotalAmount") + 0.01);
					totalAmountSumTVA = totalAmountSumTVA + 0.01;
				}
			}

			if(bookings.get(i).getXPath("is-empty(kpCurrency)")){
				bookings.get(i).setXPath("kpCurrency", m_attributes["kmFundsAccounting.kpCurrency.id"]);
			}
			if(bookings.get(i).getXPath("is-empty(kmDebitAccount)")){
				bookings.get(i).setXPath("kmDebitAccount", m_attributes["kmDebitAccount.id"]);
			}

			var releaseRules = bookings.get(i).getXPath("kmDebitAccount.kxReleaseRules");
			for(var j = 0; j < releaseRules.size(); j++){
				if(!Me.Context.getXPath("exists(kmFundsAccounting.kxReleases[kmBooking.id = "+bookings.get(i).getXPath("id")+" AND kmReleaseRule.id = "+releaseRules.get(j).getXPath("id")+"])")){
					var release = Me.Context.newCollectionItem("kmFundsAccounting.kxReleases");
					release.setXPath("kmReleaseRule", releaseRules[j].getXPath("id"));
					release.setXPath("kmBooking", bookings.get(i).getXPath("id"));
					if(releaseRules[j].getXPath("count(kxInternalApproverIndividu)") > 0){
						release.setXPath("ksInternalApprover", releaseRules[j].getXPath("kxInternalApproverIndividu").get(0).getXPath("ksUser.idUser"));
					}

					release.setXPath("kpDepartment", releaseRules[j].getXPath("kpDefaultApproverDepartmen"));
					release.setXPath("sExternalApproverMail", releaseRules[j].getXPath("sDefaultExternalApprover"));
				}
		    }

			var otherRules = bookings.get(i).getXPath("kmDebitAccount.kxOtherRules");
			for(var j = 0; j < otherRules.size(); j++){
				if(!Me.Context.getXPath("exists(kmFundsAccounting.kxAdditionalTasks[kmBooking.id = "+bookings.get(i).getXPath("id")+" AND kmRule.id = "+otherRules.get(j).getXPath("id")+"])")){
					var additionalTask = Me.Context.newCollectionItem("kmFundsAccounting.kxAdditionalTasks");
					additionalTask.setXPath("kmRule", otherRules[j].getXPath("id"));
					additionalTask.setXPath("kmBooking", bookings.get(i).getXPath("id"));
					additionalTask.setXPath("sExternalApproverMail", otherRules[j].getXPath("sDefaultOkaytoPayMail"));
					additionalTask.setXPath("kpDepartment", otherRules[j].getXPath("kpDefaultOkayToPayDepart"));
					if(otherRules[j].getXPath("count(kxOkayToPayPerformers)") > 0){
						additionalTask.setXPath("ksInternalApproverIndivid", otherRules[j].getXPath("kxOkayToPayPerformers").get(0).getXPath("ksUser.idUser"));
					}
					if(otherRules[j].getXPath("kpRuleType.sCode") == "02" && otherRules[j].getXPath("is-empty(kpDefaultOkayToPayDepart)") && otherRules[j].getXPath("is-empty(ksDefaultOkaytoPayIndivi)")){
						if(m_attributes["kpTeam.sCode"] == "01"){
							additionalTask.setXPath("kpDepartment", CHelper.getEntityAttrib("P_DPFI_Area","idP_DPFI_Area"," sCode = '019' "));
						} else {
							additionalTask.setXPath("kpDepartment", CHelper.getEntityAttrib("P_DPFI_Area","idP_DPFI_Area"," sCode = '020' "));
						}
					}
				}
			}
		}

		var releaseRules = CHelper.GetValueAsCollection(m_attributes["kmFundsAccounting.kxReleases"]);

		for(var i = 0; i < releaseRules.size(); i++){
			if(!Me.Context.getXPath("exists(kmFundsAccounting.kxBookings[id = "+releaseRules.get(i).getXPath("kmBooking.id")+"])")){
				Me.Context.deleteCollectionItem("kmFundsAccounting.kxReleases", Me.Context.getXPath("kmFundsAccounting.kxReleases[id = "+releaseRules.get(i).getXPath("id")+"]"));
			}
		}

		var additionalTasks = CHelper.GetValueAsCollection(m_attributes["kmFundsAccounting.kxAdditionalTasks"]);

		for(var i = 0; i < additionalTasks.size(); i++){
			if(!Me.Context.getXPath("exists(kmFundsAccounting.kxBookings[id = "+additionalTasks.get(i).getXPath("kmBooking.id")+"])")){
				Me.Context.deleteCollectionItem("kmFundsAccounting.kxAdditionalTasks", Me.Context.getXPath("kmFundsAccounting.kxAdditionalTasks[id = "+additionalTasks.get(i).getXPath("id")+"]"));
			}
		}

		var bookingsInterim = CHelper.GetValueAsCollection(Me.Context.getXPath("kmFundsAccounting.kxBookings[kmDebitAccount.bInterimAccount = true AND bIsTVA != true]"));

		for(var i = 0; i < bookingsInterim.size(); i++){
			bookingsInterim.get(i).setXPath("kmRecipientAccountSupplier", m_attributes["kmFundsAccounting.kmSupplierAccount.id"]);
			bookingsInterim.get(i).setXPath("fTotalAmount", CHelper.Math.Round((m_attributes["kmFundsAccounting.fTotalAmount"] / bookingsInterim.size()), 2));
		}

		bookingsInterim = CHelper.GetValueAsCollection(Me.Context.getXPath("kmFundsAccounting.kxBookings[kmDebitAccount.bInterimAccount = true AND bIsTVA = true]"));

		for(var i = 0; i < bookingsInterim.size(); i++){
			bookingsInterim.get(i).setXPath("fTotalAmount", CHelper.Math.Round((m_attributes["fTotalAmount"] / bookingsInterim.size()), 2));
		}
	}
}

m_attributes["kmFundsAccounting.kmTotalizerBookings.fTotalAmount"] = Me.Context.getXPath("sum(M_DPFI_FundsAccount.kxBookings[kmDebitAccount.bInterimAccount != " + "true" + " AND bIsTVA != true].fTotalAmount)");
m_attributes["kmFundsAccounting.kmTotalizerBookings.iCount"] = Me.Context.getXPath("count(M_DPFI_FundsAccount.kxBookings[kmDebitAccount.bInterimAccount != " + "true" + " AND bIsTVA != true].fTotalAmount)");
m_attributes["kmFundsAccounting.kmTotalizerBookings.fIndividualSplitting"] = Me.Context.getXPath("sum(M_DPFI_FundsAccount.kxBookings[kmDebitAccount.bInterimAccount != " + "true" + " AND bIsTVA != true].fIndividualSplitting)");
//__1

Date Time:
7/4/2022 1:58:02 PM
Source:
Microsoft.JScript
Message:
Attribute kmFundsAccounting not found in the Scope chain 

Stack Trace:
   at Microsoft.JScript.LateBinding.Call(Object[] arguments, Boolean construct, Boolean brackets, VsaEngine engine)
   at Microsoft.JScript.Call.Evaluate()
-------------------------------------------------------Date Time:
7/4/2022 1:58:02 PM
Source:
BizAgi.EntityManager
Message:
Attribute kmFundsAccounting not found in the Scope chain
Stack Trace:
   at BizAgi.ContextManager.AbstractProcessScope.FindScopeAttribute(String name)
   at BizAgi.ContextManager.AbstractProcessScope.GetPropertyValue(String propertyName)
   at BizAgi.PAL.BeanUtils.PropertyUtils.getProperty(Object bean, String name)
   at BizAgi.PAL.BeanUtils.BAPropertyUtils.getProperty(Object bean, String name)
-------------------------------------------------------
---------Aditional Information -----------
idCase = 0
idWorkitem = 252137
idTask = 0
idUser = 5052
idRule = 0

Here is my config:

filebeat.inputs:

- type: log
  paths:
    #- c:\Bizagi_Logs\WorkPortal\*
    - d:\Bizagi\Projects\BPM_HuA\Tracetest\BPM_HuA*.log
  parsers:
  - multiline:
    pattern: '^Error Date:'  (But even wildcard (.*) should work or not)
    negate: true
    match: after
    max_lines: 1000000
    #flush_pattern: "(not&find)"   #End of Line if he finds this pattern or not?
    skip_newline: false

I want to display this whole files as 1 event. But it always splits and I wonder why.

2

I think you're missing the type of which aggregation method to use. Try adding the following:

parsers:
- multiline:
  type: pattern
  ...

Should fix your issue.

3

Hi Ossenfeld unfortunately that doesn't work either.
I tried also

  multiline:
    type: count
    #pattern: '^Error Date:'
    #negate: true
    count_lines: 1000000
    #match: after
    max_lines: 1000000

which should 100% work since it aggregated a defined number of lines. But also this splits for no reasons.

4

I took a look at my notes and I think there was a mistake in the documentation and the stuff below multiline has to be indented:

  parsers:
  - multiline:
      type: pattern
      pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}'
      match: after
      negate: true
5

I tried as shown below but it does not change it's behaviour.

filebeat.inputs:

- type: log
  parsers:
  - multiline:
    type: pattern
    pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}'
    match: after
    negate: true
  #multiline:
     # type: pattern
     # pattern: '^Error Date:'
     # negate: true
      #count_lines: 1000000
     # match: after
      #max_lines: 1000000
    #flush_pattern: "(not&find)"   #End of Line if he finds this pattern or not?
    #skip_newline: false
  paths:
    #- c:\Bizagi_Logs\WorkPortal\*
    - d:\Bizagi\Projects\BPM_HuA\Tracetest\BPM_HuA*.log
6

Hi @Mister_Alladin , have you try using these example

- type: log
  enabled: true
  paths:
    - "/path/to/log"
  multiline.type: pattern
  multiline.pattern: 'your_pattern'
  multiline.negate: true
  multiline.match: after
  multiline.max.lines: 1000000
7

Indent as shown in my example, then it should work.

8

@lzold_z
thank you both I found 2 strange things in filebeat first of all.

  1. If i activate/uncomment my second input the first input is not working anymore correct???
    Is it even possible to have multiline for 2 different inputs? (would be strange if not this would be a huge limitation).
filebeat.inputs:


- type: log
  enabled: true
  paths:
    - d:\Bizagi\Projects\BPM_HuA\Tracetest\BPM_HuA*.log
  multiline.type: pattern
  multiline.pattern: '^Error Date:'
  multiline.negate: true
  multiline.match: after

#IF I comment out  this the input above doesn't work anymore but why?
- type: log
  #id: bizagi-filestream-id
  paths:
   - d:\Bizagi\Projects\BPM_HuA\Tracetest\*
  exclude_lines: ["#"]
  exclude_files: ["^BPM_HuA*"]
  1. I tried also multiline.type: count and multiline.count_lines: 10000 but in this case he never finishes a document and I never get any event for any file (is this a bug maybe).


- type: log
  enabled: true
  paths:
    - d:\Bizagi\Projects\BPM_HuA\Tracetest\BPM_HuA*.log
  multiline.type: count
  multiline.count_line: 10000
  #multiline.type: pattern
  #multiline.pattern: '^Error Date:'
  #multiline.negate: true
  #multiline.match: after
9

Does somebody understand why my pattern works with this (commented the other log out):

- type: log
  enabled: true
  paths:
    - d:\Bizagi\Projects\BPM_HuA\Tracetest\BPM_HuA*.log
  multiline.type: pattern
  multiline.pattern: '^Error Date:'
  multiline.negate: true
  multiline.match: after

#- type: log
  #id: bizagi-filestream-id
#  paths:
#   - d:\Bizagi\Projects\BPM_HuA\Tracetest\*
#  exclude_lines: ["#"]
  #exclude_files: ["^BPM_HuA*"]

but does not work with this:

- type: log
  enabled: true
  paths:
    - d:\Bizagi\Projects\BPM_HuA\Tracetest\BPM_HuA*.log
  multiline.type: pattern
  multiline.pattern: '^Error Date:'
  multiline.negate: true
  multiline.match: after

- type: log
  #id: bizagi-filestream-id
  paths:
   - d:\Bizagi\Projects\BPM_HuA\Tracetest\*
  exclude_lines: ["#"]

Also the multiline_type: count seems not work in any case (so I could atleast display all log files as 1 event even if this is unperformant):

 multiline.type: count
 multiline.count_lines: 10000
 multiline.close_inactive: 1m

Are these bugs or huge limitations?
Do I need a second filebeat running if I need to adapt other log files in this case?
This makes working with filebeat not really easy or possible if you have bad formated log files.

10

In your second configuration you are telling filebeat to collect some logs that is already collecting in the frist input, one has the multiline option and the other do not have the multline option, I'm not sure this work.

Your filebeat paths for your inputs should not overlap which each other, your second filebeat path is overlapping with your first filebeat path, as I said, I'm not sure if this works, but if it works you will at least get duplicated logs.

11

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.