I think your test was a false negative -- I just tried this configuration and it worked fine on those lines. I think what you're seeing is that when you append the lines with echo, Filebeat reads them as soon as they're added, which means by the time you run echo c, the previous line has already been ingested, and it has to start a new one. (I replicated this on my system by delaying slightly between the two echo commands.) If you instead use cat to append the multiline entries, or start Filebeat when the entry is already complete, then it seems to work fine.
Thanks Fae, you are right, it is working by using 'cat'.
BTW: I thought FileBeat won't send the event until it matches the next pattern, and also it has the timeout property to define how long time it will wait, is it right?
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.