A few things now:
-
It appears only the last condition statement works. Meaning in the above configuration, only the "stage" namespace is being looked at.
-
Our logs are sent by the apps are multi-line but are not being sent by Filebeat via multi-line no matter what I try to make the multiline.pattern. Is that not observed with autodiscover?
Thanks again!