Filebeat multiline equivalent of logstash "what"

Elastic Stack Beats
1

Hello.

I'm looking to append a java stacktrace to the previous log line which is the application error. I was previously able to achieve this in logstash with the following:

multiline {
            pattern => "(^.+Exception: .+)|(^\s+at .+)|(^\s+... \d+ more)|(^\s*Caused by:.+)"
            patterns_dir => "/opt/logstash/etc/patterns"
            what => "previous"
}

Is this possible in filebeat?

  pattern: '(^.+Exception: .+)|(^\s+at .+)|(^\s+... \d+ more)|(^\s*Caused by:.+)'
  negate: false
  match: after
  max_lines: 5000
2

Never mind. it works. Had an issue with the regex.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.