I'm currently using fluentd/td-agent to ship logs to elasticsearch and use kibana for visualization.
In fluentd you can specify when tailing logs which is the first line of a multi-line log(for instance java errors).
And basically use regexp to split the message into fields.
But since td-agent doesn't do well with milliseconds currently, I am looking for other options to ship logs to elasticsearch.
Skimming the documentation on filebeats, the configuration seems fairly easy. But I see is no mention of multi-line log files.
We do have a lot of Java applications that generate errors that are split into multiple lines..
I'm wondering how it works beats. Do we need to use logstash to handle it or is filebeats enough? In that case how does beats handle it?