Filebeat Multiline Logger Issues

Elastic Stack Beats
1

HI All

I need help to find out why my multiline line not working with filebeat , I already all the help avaliable on internet - i am using 6.3.0 version of filebeat

my filebeat.yml is as below

filebeat.prospectors:

  • type: log
    paths:
    • /tc1/fs_users/tccrb11/test.log

multiline.pattern: '^Thread'
multiline.negate: true
multiline.match: after

output.logstash:
hosts: ["10.38.129.39:5044"]

My logs pattern is like below where each block starting with "Thread id"

=================================
Thread id=140568527824640
Message id: 0
Severity: INFO
File: sources/gadjbase/base/src/GetProperty.cpp
Function: GetProperty::getBoolParamFromConfTable
Line: 112
Time: Wed Jun 20 12:28:57

Message text: The conf param ABORT_ON_REJECTED_ROLLING_EVENT has value in DB. The value is set to TRUE

Thread id=140568527824640
Message id: 0
Severity: INFO
File: sources/gadjbase/base/src/GetProperty.cpp
Function: GetProperty::getBoolParamFromConfTable
Line: 112
Time: Wed Jun 20 12:28:57

Message text: The conf param DISABLE_CC_EAGERLOAD_CHECK has no value in DB. The value is set to default FALSE

I am always getting line by message in flibeat (publish option) and in logstach

2

Could you please format your config and example logs using </>?

3

Hi
Can someone please help here

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.