How to make multiline to work when deploy filebeat to openshift 3.11

I deploy filebeat to openshift 3.11.
the log is json format like this :

{"log":"W0922 10:48:03.257983 1 reflector.go:341] github.com/kubernetes-incubator/external-storage/lib/controller/controller.go:668: watch of *v1.StorageClass ended with: The resourceVersion for the provided watch is too old.\n","stream":"stderr","time":"2021-09-22T10:48:03.258127725Z"}
{"log":"W0922 10:52:30.614798 1 reflector.go:341] github.com/kubernetes-incubator/external-storage/lib/controller/controller.go:665: watch of *v1.PersistentVolume ended with: The resourceVersion for the provided watch is too old.\n","stream":"stderr","time":"2021-09-22T10:52:30.614938249Z"}

and my config filebeat.yml is below:
inputs:
path: ${path.config}/inputs.d/.yml
reload.enabled: false
modules:
path: ${path.config}/modules.d/
.yml
reload.enabled: false

filebeat.autodiscover:
providers:
- type: kubernetes
include_pod_uid: true
hints.enabled: true
templates:
- condition.regexp:
kubernetes.container.name: '.+'
config:
- type: docker
containers:
path: "/var/log/pods/*${data.kubernetes.pod.uid}/"
ids:
- "${data.kubernetes.container.name}"
multiline.pattern: '^[[:space:]]'
multiline.negate: false
multiline.match: after
processors:
- decode_json_fields:
process_array: true
max_depth: 10
target: ""
overwrite_keys: true
fields: ["message"]

processors:

  • add_cloud_metadata:
  • drop_event:
    when:
    equals:
    kubernetes.container.name: "filebeat"
  • drop_event:
    when:
    regexp:
    message: "^DBG:"

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.