Messages in Kibana appear truncated

Elastic Stack Kibana
1

I have an ELK implementation on a single server as a test box, I am receiving log data from a Mulesoft cluster via Filebeats at the source, received by Logstash at the server. When I view what should be a 3000+ line of log message in Kibana, I only get the first 500 lines.

Looking at the raw JSON document, I see the log.flag set to truncated multiline in the document.

How can I influence this behavior to allow all lines from the original message to pass unaltered?

2

Look at this doc page, multiline.max_lines defaults to 500.

3

Thanks Len. Looks like this should be pretty easy - I've added "multiline.maxlines: 4000" to the affected log entries. I should be able to modify them on server tomorrow and have the dev team test tomorrow as well.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.