Filebeats missing last line when used with multi line

Elastic Stack Beats
1

I have set up filebeat and used multi line pattern to get the full file content as below.
My requirement is to move whole file content of the file as a single event. I used multiline to achieve it.

multiline:
pattern: "/.*./gm"
negate: true
match: after
max_lines: 20000

If the file has new line at the end, it is taking last line, else, it is ignoring the line.

Please suggest the configuration change, that will take care of this situation.

1 Like
2

Filebeat always waits for the end of the line before considering the line complete, even considering the timeout option. See below.

1 Like