The last few days I have been struggling with a multiline pattern. My multiline log messages have a pattern like 'abbbc'. I don't need the b-parts to be send to LogStash. So basically what I want to accomplish is to convert a multiline log message like
a b b b c
Unfortunately the "exclude_lines" parameter is handled after the "multiline.pattern" parameter in the filebeat.yml.
Any ideas on how to crack this case?