Filebeat multiline with hints enabled

I've read the multiline documentation so many times now, I am seeing triple.

Our logs are in JSON format and stack traces appear like the example below. When using hints based autodiscovery, is this the correct syntax to use?

    - type: docker
      hints.enabled: true
      multiline.type: pattern
      multiline.pattern: '[[:space:]]'
      multiline.negate: false
      multiline.match: after
      json.overwrite_keys: true
      json.keys_under_root: true
      json.add_error_key: true

Example log with Java stack trace:

{"@timestamp":"2020-08-18T16:43:13.397Z", "log.level":"ERROR", "message":"Servlet.service() for servlet [dispatcherServlet] in context with path [] threw exception [Request processing failed; nested exception is java.lang.NullPointerException] with root cause", "":"muy-cool-app","":"http-nio-5000-exec-5","log.logger":"org.apache.catalina.core.ContainerBase.[Tomcat].[localhost].[/].[dispatcherServlet]","log.origin":{"":"","function":"log","file.line":181},"error.type":"java.lang.NullPointerException","error.stack_trace":[
	"\tat com.specialized.v2.api.serialnumber.SerialNumberUpload.upload(",
	"\tat com.specialized.v2.api.serialnumber.SerialNumberUploadController.serialNumberUpload(",

Even the most basic examples (any line that is not the start of an object) aren't collapsing. I've tried several different match patterns in the Go playground and they pass, which makes me think I'm simply not using it correctly in my Filebeat config. I'm confused by the co.elastic.logs/multiline.pattern syntax I see sometimes.

Any help here would be greatly appreciated, I am at my wit's end trying to collapse these stack traces. :nauseated_face: Currently on 7.9.0.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.