I'm having an issue with filebeat multiline events.
All log file is being published as 1 long message.
My log lines looks like:
"GS category US severity..."
The GS is group seperator in unicode, and filebeat reads ir as "\u001d" and logstash receives it as "\u001D"
If i'm changing the log to start lines with different seperator, for example "--".
Can it be a filebeat bug that it can't recognize the GS seperator correctly, or maybe my pattern is incorrect?