Filebeat send ' \u0000 ' and the event loss and the new line append to the last line

my config is as follow:

      filebeat.inputs:
        - type: filestream
          enabled: true
          id: filebeat-input-log
          paths:
            - /app/log/*/*.log
          parsers:
            - multiline:
                type: pattern
                pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}'
                negate: true
                match: after
                max_lines: 100000
                timeout: 20s
          exclude_lines: ['^[0-9]{4}-[0-9]{2}-[0-9]{2}\s*.*?\s*--(\s|\s(-|v+|\^+))$']
          close.on_state_change.inactive: 6h
          close.on_state_change.renamed: true
          ignore_older: 24h
      processors:
        - add_id: ~
        - drop_fields:
            fields: ["ages", "ls", "ht"]
      output.logstash:
        hosts: ["logstash:5044"]

filebeat version: 7.16.2 (amd64)
server: linux
desription:
some '\u0000' was produced after filebeat harvested where the log was loss and the new line append to the last line .

as the picture shows in the end ,'2022-09-08' should be the beginning of a new line but it append to the end of �.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.