Filebeat process multi-line AND one-line XML

Elastic Stack Beats
1

Hello guys.
I have the following filebeat configuration to retrieve XML files.

filebeat.prospectors:
    - type: log
      paths:
        - ${LOGGING_FILE}
      multiline.pattern: '.'
      multiline.match: after

Each XML should be an event.

That's works ONLY if I have an indented XML.

How can I retrieve both indented XML and minified XML (one-line per file)?

2

In my tests, your conf works both for single and multiline files.

Can you check that your single-line files have a newline at the end?

Filebeat requires lines to be correctly terminated, otherwise it will keep waiting in case more data is added to the line.

3

That should be the problem.
These files don't have newline.

4

That's the problem :slight_smile:

Filebeat requires lines to be terminated (by a newline). Otherwise, there is no possible way for filebeat to tell if the program writing to the log has finished the line or it was just caught in the middle of writing a line (for programs that use buffering).

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.