Logs with lime breaks not working with multiline


(Amrutha P Bhat) #1

I have a file in the below format
Ex:

This is the first line.

This is the second line.

I am using no pattern since I want all the lines in the text to send to Logstash which is around 2000 lines.

If the file is in the below format it works.
Ex:

This is the first line.
This is the second line.

If the file is in the above format multiline works.

Could you please help me out with this.


(Andrew Kroh) #2

Please provide the Filebeat prospector config that are you using.


(Amrutha P Bhat) #3
filebeat:
  prospectors:

    -
      paths:
        - /home/ubuntu/containers.d/*/*.log

      input_type: log

      document_type: syslog

      multiline:
        match: after
        max_lines: 2000

(Amrutha P Bhat) #4

Hi @andrewkroh,

Do you have any update on the above?


(Carlos PĂ©rez Aradros) #5

Please don't open 2 threads for the same issue :slight_smile:


(Amrutha P Bhat) #6

@exekias Sorry for the trouble


(Andrew Kroh) #7