Filebeat prospector_format

Elastic Stack Beats
1

Hi, i have below settigs in filebeat.yaml
type: log
multiline.pattern: '^<!--'
multiline.negate: true
multiline.match: after

below is the message I m trying stream into ECS. But in ECS all the below lines are formatted as a separate message. Is there a way file beat will read the below as one single message

<ExecuteMultipleOperations_Transaction>
ExecuteMultipleOperations
hostname
https://hostname.domain.local/svc
hostname$
87

00:00:00.0300000

</ExecuteMultipleOperations_Transaction>

2

You your log messages are always between XML tags you can use the following multiline options:

multiline.pattern: ^</
multiline.negate: true
multiline.match: before
1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.