Filebeat process multi-line AND one-line XML

Hello guys.
I have the following filebeat configuration to retrieve XML files.

    - type: log
        - ${LOGGING_FILE}
      multiline.pattern: '.'
      multiline.match: after

Each XML should be an event.

That's works ONLY if I have an indented XML.

How can I retrieve both indented XML and minified XML (one-line per file)?

In my tests, your conf works both for single and multiline files.

Can you check that your single-line files have a newline at the end?

Filebeat requires lines to be correctly terminated, otherwise it will keep waiting in case more data is added to the line.

That should be the problem.
These files don't have newline.

That's the problem :slight_smile:

Filebeat requires lines to be terminated (by a newline). Otherwise, there is no possible way for filebeat to tell if the program writing to the log has finished the line or it was just caught in the middle of writing a line (for programs that use buffering).

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.