Logs with lime breaks not working with multiline

Elastic Stack Beats
1

I have a file in the below format
Ex:

This is the first line.

This is the second line.

I am using no pattern since I want all the lines in the text to send to Logstash which is around 2000 lines.

If the file is in the below format it works.
Ex:

This is the first line.
This is the second line.

If the file is in the above format multiline works.

Could you please help me out with this.

2

Please provide the Filebeat prospector config that are you using.

3 
filebeat:
  prospectors:

    -
      paths:
        - /home/ubuntu/containers.d/*/*.log

      input_type: log

      document_type: syslog

      multiline:
        match: after
        max_lines: 2000
4

Hi @andrewkroh,

Do you have any update on the above?

5

Please don't open 2 threads for the same issue :slight_smile:

6

@exekias Sorry for the trouble