Filebeats multiline pattern - specific syntax

Elastic Stack Beats
1

I want to set specific syntax as multiline pattern.
so I test in logstash first and It works.

this is logstash's configration.
input {
stdin {
codec => multiline {
pattern => 'execute_all srv'
what => "previous"
negate => true
}
}
}

I copy this configuration to filebeats it doesn't works. I don't know why
this is my filebeat.yml multiline setting.

multiline.pattern: 'execute_all srv'
multiline.match: after
multiline.max_lines: 500

Is there has any way to setting specific syntax as multiline pattern?

I need your help

2

I solve this problem.
I just didn't add multiline.negate:true.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.