Multiline and blank lines

Elastic Stack Beats
1

I've the following multiline pattern

multiline.pattern: '^\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}.\d{3}'
multiline.negate: true
multiline.match: before

Using the Go playground https://play.golang.org/p/uAd5XHxscu, I can see that lines are correctly matched.

The problem is that there is an empty line in the logs between the error message and the begin of the stack trace. When I send the output of Filebeat to stdout, I observe two events, one for the error message and one for the whole stack trace.

My hypothesis, is that as empty lines are dropped by Filebeat, it makes it impossible to connect the stack trace to the error message.

Are you aware of this problem, is there some workaround?

2

Could you share some example logs?

3

I've built a crafted test log file and discovered that it's not a problem of Filebeat.
You can delete this topic.
Thank you for your support.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.