Having an issue enabling proper multiline options for container logs

Elastic Stack Beats
,
1

Currently have these settings enabled, hoping to make all logs that start with a date like: 2020-11-27 to be in their own entry, including java stack traces.

multiline.type: pattern
multiline.pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}'
multiline.negate: true
multiline.match: after

The result is lines showing up like this in one entry in Kibana:

2020-11-27 20:03:23.370 [INFO][48] felix/int_dataplane.go 1245: Applying dataplane updates
2020-11-27 20:03:23.371 [INFO][48] felix/wireguard.go 578: Wireguard is not enabled
2020-11-27 20:03:23.371 [INFO][48] felix/table.go 877: Invalidating dataplane cache ipVersion=0x4 reason="refresh timer" table="filter".

Anyone have an idea of how to configure this?

2

Hi!

It seems your defined pattern is not correct.
You can find multiline examples at https://www.elastic.co/guide/en/beats/filebeat/master/multiline-examples.html and also a playground to exepriment with your patterns.

Please give it a try and let us know!

Thanks!

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.