Filebeat to logstash multiline issue with network

Greetings,
I installed file beat 7.12 with multiline pattern and the output is log stash 7.12 the problem is when file beat be in same network subnet the multiline shipped correctly
otherwise with a different network subnet, the multiline dropped as attached image

multiline setting

I think u may need to update your multi line pattern. The logs above the line are not multi line while the one below is.

Thank you @legoguy1000 .

i tested same log file with same file beat multiline setting one from the same network subnet and this shipped correctly like last log in the attached image.


and other from different network subnet and logs not shipped correctly like two first line in the attached image

what did u update the multiline pattern too? I don't have a a lot of experience with the multiline settings. I would look at Manage multiline messages | Filebeat Reference [7.12] | Elastic for more info.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.