Running Windows 10, Logstash 8.1.0, Elasticsearch, kibana and filebeat 8.0.0 all on the same machine. Getting the data from logstash into elasticsearch and kibana works but when multiple files get read at the same time the files with multiple lines are seen as only one record. here is the pipeline…

[image] RomanKau: include_lines: [A-Za-z0-9] This part of your config is wrong. You need to surround the regular expression with quotes, like this: include_lines: '[A-Za-z0-9]' I guess you have this fixed in your setup, otherwise you wouldn't be ingesting any data due to this error. If …

Logstash reads file with multiple lines as "1 hit"

Elastic Stack Logstash

RomanKau (Roman) May 11, 2022, 8:07am 18

Yeah it is quite weird. If I remember correctly it was without the ' ' in the filebeat reference documentation so I didnt think this was the issue but apparently it was.

Thanks again.

Topic		Replies	Views
Allow logstash to store multi-line messages Logstash	2	415	June 14, 2018
Duplicate Entries for multiline log processed by Logstash Logstash	1	752	December 21, 2017
Messages from different files are combined as one document Beats filebeat	3	962	July 5, 2017
Merge lines in filebeat + logstash Beats filebeat	12	3539	July 5, 2017
Issue with Multiline Logs Beats filebeat	2	641	September 14, 2017

Logstash reads file with multiple lines as "1 hit"

Related topics