Filebeat process multi-line AND one-line XML

[thpoiani (Thiago Henrique Poiani)]

Hello guys.
I have the following filebeat configuration to retrieve XML files.

filebeat.prospectors:
    - type: log
      paths:
        - ${LOGGING_FILE}
      multiline.pattern: '.'
      multiline.match: after

Each XML should be an event.

That's works ONLY if I have an indented XML.

How can I retrieve both indented XML and minified XML (one-line per file)?

[adrisr (Adrian Serrano)]

In my tests, your conf works both for single and multiline files.

Can you check that your single-line files have a newline at the end?

Filebeat requires lines to be correctly terminated, otherwise it will keep waiting in case more data is added to the line.

[thpoiani (Thiago Henrique Poiani)]

@adrisr

Can you check that your single-line files have a newline at the end?

That should be the problem.
These files don't have newline.

[adrisr (Adrian Serrano)]

That's the problem

Filebeat requires lines to be terminated (by a newline). Otherwise, there is no possible way for filebeat to tell if the program writing to the log has finished the line or it was just caught in the middle of writing a line (for programs that use buffering).