Hello, I have the following configuration in filebeat.yml
and the multiline feature is NOT working as expected.
I have read previous posts with this issue, but the difference is that i'm NOT using prospectors or inputs. I'm using autodiscover.
Single line events are working properly, however multiline events never show up in kibana.
This is my filebeat.yml
:
filebeat.autodiscover:
providers:
- type: docker
templates:
- condition.contains:
docker.container.image: "xxxxxx"
config:
- type: log
paths:
- "/var/lib/docker/containers/${data.docker.container.id}/*.log"
json.keys_under_root: true
json.add_error_key: true
json.message_key: log
multiline.pattern: '^.,'
multiline.negate: true
multiline.match: after
exclude_lines: ['healthcheck']
encoding: utf-8
close_inactive: 5m
setup.template.enabled: true
setup.template.name: "xxxx"
setup.template.pattern: "xxxx*"
setup.kibana:
host: "xxxx"
processors:
- add_host_metadata:
netinfo.enabled: true
- add_cloud_metadata: ~
- add_docker_metadata: ~
output.logstash:
hosts: ["xxxxx"]
xpack.monitoring:
enabled: true
elasticsearch:
hosts: ["xxxxxx"]
Also, logstash is sending this log:
[2019-09-04T19:07:44,750][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch.
{:status=>400,
:action=>
["index",
{
:_id=>"2eaacaee422a4b52e5e7bbe926a9beac781d53b014face27edca98f4f9f83dc3",
:_index=>"xxxxxxxxx",
:_type=>"doc",
:routing=>nil
},
#<LogStash::Event:0x684e8b88>
],
:response=>{
"index"=>{
"_index"=>"xxxxxxxx",
"_type"=>"doc",
"_id"=>"2eaacaee422a4b52e5e7bbe926a9beac781d53b014face27edca98f4f9f83dc3",
"status"=>400,
"error"=>{
"type"=>"mapper_parsing_exception",
"reason"=>"failed to parse field [message] of type [text]",
"caused_by"=>{
"type"=>"illegal_state_exception",
"reason"=>"Can't get text on a START_OBJECT at 1:52"
}
}
}
}
}