Filebeat multiline pattern with negate works for all logs even without pattern

Elastic Stack Beats
1

Hi! I want to use multiline for Java stacktraces. I use following configuration:

- type: docker
  multiline:
    pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}'
    negate: true
    match: after

It works fine for java logs, but it also concatenates nginx logs and my golang application logs (that's definitely not what I need).
I can't figure out why it is works that way. I checked it on the Golang Playground https://play.golang.org/p/uAd5XHxscu and it seems correct.
Filebeat should concatenate strings after the negate pattern and before the next one, shouldn't it? But it concatenates everything, ignoring the pattern.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.