Filebeat multiline pattern with negate works for all logs even without pattern

Hi! I want to use multiline for Java stacktraces. I use following configuration:

- type: docker
    pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}'
    negate: true
    match: after

It works fine for java logs, but it also concatenates nginx logs and my golang application logs (that's definitely not what I need).
I can't figure out why it is works that way. I checked it on the Golang Playground and it seems correct.
Filebeat should concatenate strings after the negate pattern and before the next one, shouldn't it? But it concatenates everything, ignoring the pattern.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.