Commonly I can use the below pattern to collect logs from multiline.
multiline.pattern: '^[[:space:]]+(at|\.{3})[[:space:]]+\b|^Caused by:'
multiline.negate: false
multiline.match: after
But in my use case, my server runs in docker, and I start filebeat to collect log form docker container stout, such as
{"log":"2023-02-02 09:48:39.176 ERROR 1 --- [19094-thread-28] c.x.z.w.c.s.c.h.HttpClient : Connect to rivers-uat.xsyxsc.cn:80 [rivers-uat.xsyxsc.cn/10.255.17.1] failed: connect timed out\n","stream":"stdout","time":"2023-02-02T01:48:39.184841549Z"}
{"log":"\n","stream":"stdout","time":"2023-02-02T01:48:39.18489938Z"}
{"log":"org.apache.http.conn.ConnectTimeoutException: Connect to rivers-uat.xsyxsc.cn:80 [rivers-uat.xsyxsc.cn/10.255.17.1] failed: connect timed out\n","stream":"stdout","time":"2023-02-02T01:48:39.18490839Z"}
{"log":"\u0009at org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:151) ~[httpclient-4.5.13.jar!/:4.5.13]\n","stream":"stdout","time":"2023-02-02T01:48:39.184916366Z"}
{"log":"\u0009at org.apache.http.impl.conn.PoolingHttpClientConnectionManager.connect(PoolingHttpClientConnectionManager.java:376) ~[httpclient-4.5.13.jar!/:4.5.13]\n","stream":"stdout","time":"2023-02-02T01:48:39.184923779Z"}
{"log":"\u0009at org.apache.http.impl.execchain.MainClientExec.establishRoute(MainClientExec.java:393) ~[httpclient-4.5.13.jar!/:4.5.13]\n","stream":"stdout","time":"2023-02-02T01:48:39.184959016Z"}
{"log":"\u0009at org.apache.http.impl.execchain.MainClientExec.execute(MainClientExec.java:236) ~[httpclient-4.5.13.jar!/:4.5.13]\n","stream":"stdout","time":"2023-02-02T01:48:39.18496622Z"}
{"log":"\u0009at org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec.java:186) ~[httpclient-4.5.13.jar!/:4.5.13]\n","stream":"stdout","time":"2023-02-02T01:48:39.184972766Z"}
{"log":"\u0009at org.apache.http.impl.execchain.RetryExec.execute(RetryExec.java:89) ~[httpclient-4.5.13.jar!/:4.5.13]\n","stream":"stdout","time":"2023-02-02T01:48:39.184979642Z"}
{"log":"\u0009at org.apache.http.impl.execchain.RedirectExec.execute(RedirectExec.java:110) ~[httpclient-4.5.13.jar!/:4.5.13]\n","stream":"stdout","time":"2023-02-02T01:48:39.184986456Z"}
{"log":"\u0009at org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:185) ~[httpclient-4.5.13.jar!/:4.5.13]\n","stream":"stdout","time":"2023-02-02T01:48:39.184992892Z"}
{"log":"\u0009at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:83) ~[httpclient-4.5.13.jar!/:4.5.13]\n","stream":"stdout","time":"2023-02-02T01:48:39.184999511Z"}
{"log":"\u0009at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:108) ~[httpclient-4.5.13.jar!/:4.5.13]\n","stream":"stdout","time":"2023-02-02T01:48:39.185005922Z"}
{"log":"\u0009at com.xsyx.zhwl.wcs.connection.service.common.http.HttpClientService.sendHttpPostRequest(HttpClientService.java:137) ~[xsyx-zhwl-wcs-connection-service-common-1.0.0-SNAPSHOT.jar!/:1.0.0-SNAPSHOT]\n","stream":"stdout","time":"2023-02-02T01:48:39.185012912Z"}
I'm wondering what pattern can i use to collect multiline log in the use case?