I am running filebeat v1.1.1 and can't seem to get multiline to work unless the input timeout passes. my data is from NNMi (trying to forward audit to ELK), the data/log looks like... 2016-03-08 14:31:49,744 INFO [com.hp.ov.nms.ui.framework.util.SignInOutAuditLog] (tomcat-exec-10) Failed Sign In …

Filebeat multiline help

ruflin (ruflin) March 9, 2016, 9:45am 2

Can you try using no quotes or single quotes around the regexp?

Topic		Replies	Views
Multiline error Beats filebeat	3	583	September 14, 2017
Multiline isn't working Beats filebeat	6	1476	July 5, 2017
Filebeat multiline regexp patterns help Beats	5	737	April 4, 2019
Trouble getting multiline working Beats filebeat	3	796	July 5, 2017
Multiline troubleshooting Beats filebeat	3	794	November 25, 2016

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Filebeat multiline help

Related topics