Hello, I am trying to setup filebeat for some multiline application logs directly to ES. So a log entry is always starting with the word "Started" or with the word "Queued" and has different number of lines each time. My filebeat.yml configuration looks like this :
multiline.pattern: '(Started) | (Queued)' multiline.negate: true multiline.match: after
But the result is that it takes almost all lines as a log entry. Is it something that I am doing wrong?