I am trying to parse catalina.out file using Logstash. All my logs starts with an timestamp field like : 2017-06-20 07:12:55.226 I tried couple of multiline patterns in filebeat yml but nothing seems to be working: pattern: " [1] {4}-[[:digit:]]{2}-[[:digit:]]{2} " pattern: '^\d{4}-\d{2}-\d{2} ' p…

Also, double check the indentation of your config file. The multiline config options are part of the prospector config so they should have the same indentation level as the paths option. filebeat: prospectors: - paths: - D:\ELK\filebeat\source\catalina.out document_type: m…

Discuss the Elastic Stack

Multiline codec in Filebeat is not working

Elastic Stack Beats

andrewkroh (Andrew Kroh) July 7, 2017, 9:44pm 3

Have you tried testing your patterns using the Go Playground as described on this page?

Topic		Replies	Views
Filebeat multiline codec not working in my case Beats filebeat	3	3855	June 6, 2017
Multiline issue with 2 different patterns for a single event Logstash	13	1503	July 6, 2017
Multiline is not working when i am sending logs to logstash through filebeat? Beats filebeat	5	805	July 2, 2017
Multiline codec in input Logstash	3	1169	July 6, 2017
Filebeat multiline works only in pair with logstash Beats	3	537	February 16, 2018

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Multiline codec in Filebeat is not working

Related topics