Hi, I set up multiline.* properties for /etc/filebeat/filebeat.yml as bellow: filebeat.inputs: - type: log paths: - /home/eip/logs/*.log tail_files: true multiline.pattern: '^%{TIMESTAMP_ISO8601}' multiline.negate: true multiline.match: after Here sample how above configuration group logs …

Filebeat - multiline pattern does not work as expected

mateusz-lubanski-omn (Mateusz Lubanski) December 11, 2018, 1:04pm 4

Below pattern solved problem:
multiline.pattern: '^\d{4}-\d{2}-\d{2} '

Topic		Replies	Views
Filebeat multiline pattern is not working Beats filebeat	2	304	February 24, 2020
Multiline configuration Beats filebeat	7	2053	August 29, 2016
Multiline patter not working for filebeat Beats filebeat	2	264	May 1, 2019
Multiline Pattern - Filebeat Beats filebeat	10	1168	October 14, 2019
Filebeat not indetifying multiple line logs Beats filebeat	2	969	October 15, 2018

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Filebeat - multiline pattern does not work as expected

Related topics