In what order are the options processed

(Aron Pedersen) #1

Is the the Multiline option run before or after the Exclude/Include option? What I would like to do is to combine lines first and then after this either Include or Exclude these combined lines.

(Steffen Siering) #2

lines are combined into multiline events first. Only full events are filtered by Exclude/lines options (filtering happens after multiline).

(Aron Pedersen) #3

Thank you Steffen.
One more observation. When I use the "filebeat -version" command (on a Windows 2012 R2 Server) for the filebeat.exe included in the it report version 1.0.0 (386)

(system) #4