I managed to puzzle out a multiline filter for Filebeat to parse PostgreSQL CSV replication logs, but I find the docs on multiline pretty lacking in examples. Right now I'm trying to figure out a pattern for merging error messages in the Elasticsearch logs themselves, which I'm ingesting into an ELK…

FIlebeat multiline pattern for Elasticsearch logs?

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

FIlebeat multiline pattern for Elasticsearch logs?