Multiline breaks on empty line \n\n restarts new line

(Tim Burt) #1

The multiline filter in filebeats works well with the default config is used:

    pattern: ^\[
    negate:  true
    match:   after

And the log lines are consecutive following the pattern.

However, if two consecutive line breaks occur in the lines that follow:

[2016-09-02 19:54:23 +0000] Started 2016-09-02 19:54:23 +0000 "GET" for /gaq?path=%2FCA%2FFallbrook%2F1845-Acacia-Ln& at
Processing by GoogleAnalyticsController#index as JSON

  Parameters: {"path"=>"/CA/Fallbrook/1845-Acacia-Ln", "referer"=>"", "search_bucket"=>"none", "page_controller"=>"v9/addresses", "page_action"=>"show"}
Completed 200 OK in 5ms (Views: 1.9ms)
[2016-09-02 19:54:23 +0000] Started 2016-09-02 19:54:23 +0000 "GET" for /health_check at xxx.xx.44.181
SetAdCodeMiddleware.default_ad_code referer
SetAdCodeMiddleware.default_ad_code path /health_check
SetAdCodeMiddleware.default_ad_code route 

The multiline processing stops at the "GoogleAnalytics" line and starts fresh with the "Parameters:" line.

Two consecutive newlines causes the multiline to restart, which does not conform to the config that new records begin with "^[".

(ruflin) #2

Which filebeat version are you using?

(Tim Burt) #3

5.0 alpha, compiled from source about 10 days ago.

(ruflin) #4

I tried to reproduce this by adding a system test to filebeat: So far it looks green.

Could you share the log output (best in debug level)?

(system) #5

This topic was automatically closed after 21 days. New replies are no longer allowed.