Hi.
I am attempting to use the multiline parser for Filebeat to chunk my Laravel log into useful segments. Laravel logs spew a multi-line stacktrace by prepending each line with #1, #2, ..., #n. Therefore, I am attempting to capture this by using the multiline.pattern feature.
Here is my attempted pattern:
multiline.pattern: '^#', multiline.pattern: '^#[0-9]', multiline.pattern: ^#
the IRC #yaml gods have agreed that all of these are valid.
However, running filebeat marks my config as valid, but attempting to start it puts this in the logs:
2017-08-14T18:21:02Z CRIT Exiting: error loading states for prospector 795983330737221375: missing required field accessing 'filebeat.prospectors.0.multiline.match' (source:'/etc/filebeat/filebeat.yml')
I have confirmed that this is the root of the error, as changing to the default (or commenting the line entirely) works fine.