Log type Filebeat deprectaed and Filestream multiline doesn't works

Elastic Stack Beats
1

I upgrade one filebeat to 7.16.3 version.

When i config my filebeat as always with this config:

- type: log
  enabled: true
  paths:
    - xx/yy.log
    - xx/yy.log
    - xx/yy.log

  tags: ["1","2"]

  encoding: ISO-8859-1
  multiline.type: pattern
  multiline.pattern: '^\[(?:0?[1-9]|1[0-2])[/-](?:(?:0[1-9])|(?:[12][0-9])|(?:3[01])|[1-9])[/-](?>\d\d){1,2}'
  multiline.negate: true
  multiline.match: after

throws the following message in the log and no data is sent

DEPRECATED: Log input. Use Filestream input instead. Will be removed in version:

so i try the filestream type instead with this config:

#  parsers:
#    - multiline:
#        type: pattern
#        pattern: '^\[(?:0?[1-9]|1[0-2])[/-](?:(?:0[1-9])|(?:[12][0-9])|(?:3[01])|[1-9])[/-](?>\d\d){1,2}'
#        negate: true
#        match: after

but it doesn't seem to work properly.

Wich is the correct syntax to make it works with filestream method ???

Thank you in advanced!

2

Please, tak a look at this thread.

It answers your question.

Best regards
Flemming

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.