How to filebeat config to multi-line?


(tei.chae) #1

Hi, guys.

I want to create a multi-line rule in filebeat.

How do I specify a multi-line rule in the format shown below?

2018:11:20 01:58:22.721 INFO  --- [http-nio-8080-exec-10] o.a.coyote.http11.Http11Processor : Error parsing HTTP request header
 Note: further occurrences of HTTP header parsing errors will be logged at DEBUG level. 
java.lang.IllegalArgumentException: Invalid character found in the request target. The valid characters are defined in RFC 7230 and RFC 3986
	at org.apache.coyote.http11.Http11InputBuffer.parseRequestLine(
	at org.apache.coyote.http11.Http11Processor.service(
	at org.apache.coyote.AbstractProcessorLight.process(
	at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(
	at java.util.concurrent.ThreadPoolExecutor.runWorker(
	at java.util.concurrent.ThreadPoolExecutor$
	at org.apache.tomcat.util.threads.TaskThread$

Also, I am already using the following values. How should I add the new rules?

multiline.pattern: '^[[:space:]]+(at|\.{3})\b|^Caused by:'
multiline.negate: false
multiline.match: after

I ask for your help.

Thank you.


To put it simply...

The time stamp format is 2018:11:20 11:51:52.477

If not in this format, I want all multi-line attached to the message.

(tei.chae) #2

it's finished.

multiline.pattern: '^[A-Z]|^[a-z]|^[[:space:]]|(at|.{3})\b|^Caused by:'
multiline.negate: false
multiline.match: after