For some reason multiline is not working, its will not display the multiline stack trace in kibana
filebeat.inputs:
- type: log
enabled: true
paths:
- /var/log/*.log
- /var/log/*messages*
- /var/log/secure
- /var/apache-tomcat-8.5.23/logs/catalina*
- /var/apache-tomcat-8.5.23/logs/*.log
multiline.pattern: '^[[:space:]]+(at|\.{3})\b|^Caused by:'
multiline.negate: false
multiline.match: after
#
filebeat.config.modules:
path: ${path.config}/modules.d/*.yml
reload.enabled: true
setup.template.settings:
index.number_of_shards: 3
setup.kibana:
host: "xxxxxxx"
output.logstash:
hosts: ["xxxxxxx"]
processors:
- add_host_metadata: ~
- add_cloud_metadata: ~
xpack.monitoring.elasticsearch.hosts: ["xxxxxxx"]
This is my filebeat, I used the multiline on the elasticsearch website but for some reason the mulitline does not show up as it should in kibana