In what order are the options processed


(Aron Pedersen) #1

Is the the Multiline option run before or after the Exclude/Include option? What I would like to do is to combine lines first and then after this either Include or Exclude these combined lines.


(Steffen Siering) #2

lines are combined into multiline events first. Only full events are filtered by Exclude/lines options (filtering happens after multiline).


(Aron Pedersen) #3

Thank you Steffen.
One more observation. When I use the "filebeat -version" command (on a Windows 2012 R2 Server) for the filebeat.exe included in the filebeat-1.1.0-nightlylatest-windows.zip it report version 1.0.0 (386)


(system) #4