I am working on a requirement where, I have to capture the multi line log messages, sending them via logstach and view them on Kibana. I am trying with version 5.1 and 5.3 versions of filebeat.
In 5.1, with the pattern matching, I am getting the result as expected and all the multi line and single line messages are aggregated and i can see them in Kibana. No issues and no line are missed.
In 5.3, with the pattern matching, If the log is ending with a multi line, except that, every line is capured as expected. When I add another line with matching pattern, the last mutli line message is now capturing.
Also irrespective of the pattern matching, every time the last time is getting missed. Is this an expected behaviour?
The nagate pattern I am using is negate: true and match: after ( in 5.1)
multiline.negate: true and multiline.match: after (in 5.3)