I am using flush pattern to extract multiline messages. Filebeat seems to be looking for the 1st occurence of the flush pattern to group the lines. Is there a way to have filebeat look for the last occurence of the flush pattern?
Can you share sample logs and your configuration? Might be easier to help if we get to know about actual problem.
date message
key value
key value
date messageA
date messageA
date messageA
The multiline messages start with a message ends with repeating lines that ate very similar.
I am using flush pattern but the problem is that the mesage gets flushed with only the first line and not looking for the last occurence of the flush pattern.
These kind of logs are no use-case for the flush-pattern. Create your multiline pattern to check for the date at the beginning of a line.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.