Multiline breaks on empty line \n\n restarts new line

Elastic Stack Beats
1

The multiline filter in filebeats works well with the default config is used:

  multiline:
    pattern: ^\[
    negate:  true
    match:   after

And the log lines are consecutive following the pattern.

However, if two consecutive line breaks occur in the lines that follow:

-------------------------------------
[2016-09-02 19:54:23 +0000] Started 2016-09-02 19:54:23 +0000 "GET" for /gaq?path=%2FCA%2FFallbrook%2F1845-Acacia-Ln&referer=http%3A%2F%2Fwww.xxxxx.com%2FAcacia%2BLn%2BFallbrook%2BCA%2Baddresses&search_bucket=none&page_controller=v9%2Faddresses&page_action=show at 23.235.47.31
X-Forwarded-For:72.197.227.93, 23.235.47.31
Processing by GoogleAnalyticsController#index as JSON

  Parameters: {"path"=>"/CA/Fallbrook/1845-Acacia-Ln", "referer"=>"http://www.xxxx.com/Acacia+Ln+Fallbrook+CA+addresses", "search_bucket"=>"none", "page_controller"=>"v9/addresses", "page_action"=>"show"}
Completed 200 OK in 5ms (Views: 1.9ms)
[2016-09-02 19:54:23 +0000] Started 2016-09-02 19:54:23 +0000 "GET" for /health_check at xxx.xx.44.181
X-Forwarded-For:
SetAdCodeMiddleware.default_ad_code referer
SetAdCodeMiddleware.default_ad_code path /health_check
SetAdCodeMiddleware.default_ad_code route 
----------------------------------

The multiline processing stops at the "GoogleAnalytics" line and starts fresh with the "Parameters:" line.

Two consecutive newlines causes the multiline to restart, which does not conform to the config that new records begin with "^[".

2

Which filebeat version are you using?

3

5.0 alpha, compiled from source about 10 days ago.

4

I tried to reproduce this by adding a system test to filebeat: https://github.com/elastic/beats/pull/2469 So far it looks green.

Could you share the log output (best in debug level)?

5

This topic was automatically closed after 21 days. New replies are no longer allowed.