Is the the Multiline option run before or after the Exclude/Include option? What I would like to do is to combine lines first and then after this either Include or Exclude these combined lines.
lines are combined into multiline events first. Only full events are filtered by Exclude/lines options (filtering happens after multiline).
Thank you Steffen.
One more observation. When I use the "filebeat -version" command (on a Windows 2012 R2 Server) for the filebeat.exe included in the filebeat-1.1.0-nightlylatest-windows.zip it report version 1.0.0 (386)