my config is as follow:
filebeat.inputs:
- type: filestream
enabled: true
id: filebeat-input-log
paths:
- /app/log/*/*.log
parsers:
- multiline:
type: pattern
pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}'
negate: true
match: after
max_lines: 100000
timeout: 20s
exclude_lines: ['^[0-9]{4}-[0-9]{2}-[0-9]{2}\s*.*?\s*--(\s|\s(-|v+|\^+))$']
close.on_state_change.inactive: 6h
close.on_state_change.renamed: true
ignore_older: 24h
processors:
- add_id: ~
- drop_fields:
fields: ["ages", "ls", "ht"]
output.logstash:
hosts: ["logstash:5044"]
filebeat version: 7.16.2 (amd64)
server: linux
desription:
some '\u0000' was produced after filebeat harvested where the log was loss and the new line append to the last line .
as the picture shows in the end ,'2022-09-08' should be the beginning of a new line but it append to the end of �.