Filebeat send the entire logfile as a single message

[saikrishnagaddipati (krishna_gaddipati)]

I am using filebeat-5.6
My config filebeat -> logstash -> elasticsearch -> kibana

I have hundreds of log files with 1KB - 2KB data( usually each file has atmost 15 lines of messages in them) in a folder. Is it possible to configure filebeat to send entire messages in each log file as a single message to elasticsearch and then view the whole log file messages in kibana's document message field.

[tudor (Tudor Golubenco)]

Filebeat reads fundamentally line by line, but I think it should be possible to use a multiline configuration to match up together everything from the file.

For example, the following should put together any lines:

  multiline.pattern: '.'
  multiline.match: after

Multiline doesn't match across files, so the EOF then works as a natural demarcation line. A quick test shows that this should work.