Using filebeat 1.1.2, i have a log event that have 3 lines and starts with the date, but the last line have no newline character. After 5 seconds, filebeat sends the 2 first lines of the event... after 10 minutes i get the same event and filebeat sends the last line of the previous event, then detects the date and start a new multiline. example:
2016-04-01 11:11:11 blabla\n _ sent after 5 s
bla bla bla\n /
bla bla no newline - sent after 10 minutes
(repeat the above lines each 10 minutes)
So looks like that multiline check will not look to the line is it doesn't end with a newline.
Only after a new event is trigger it will see it (probably the "date" is really "\ndate", but is not easy to check)
Of course the log is broke, but i can not change the app... so filebeat needs one option to "ignore missing newline on timeout" so it can catch the last line without a newline on it. Or is there any workaround for this?
Thanks in advance for the help