Multiline Config Failing

Elastic Stack Beats
1

Hi,
My filebeat prospector config looks like this:

filebeat:
    prospectors:
    -   document_type: cassandra
        input_type: log
        paths:
          - /var/log/cassandra/*.log
          - /var/log/cassandra/audit/*.log
        scan_frequency: 5s
        ignore_older: 168h
        multiline:
          pattern: "^\s"
          match: after

However, adding the multiline config causes the prospector file to fail to load. If I remove the multiline element then the config loads fine. What is wrong with this configuration?

Regards,
David

2

It looks ok to me. What error do you get?

3

Ah, I think I know what the problem is. If you use double quotes, you need to escape the backslash, "^\\s". In this case, you can also go without quotes, in which case you don't need the double backslash. I recommend passing configs through http://www.yamllint.com/ when you get weird errors like this.

4

Thanks, I've tried that and get this:
2016-04-12T15:11:54+01:00 INFO Harvester started for file: /var/log/cassandra/system.log
2016-04-12T15:11:54+01:00 ERR Stop Harvesting. Unexpected encoding line reader error: error parsing regexp: invalid escape sequence: \s
2016-04-12T15:11:54+01:00 DBG Closing file: /var/log/cassandra/system.log
2016-04-12T15:11:54+01:00 DBG Check file for harvesting: /var/log/cassandra/audit/dropped-events.log
2016-04-12T15:11:54+01:00 DBG Update existing file for harvesting: /var/log/cassandra/audit/dropped-events.log
2016-04-12T15:11:54+01:00 DBG Not harvesting, file didn't change: /var/log/cassandra/audit/dropped-events.log
2016-04-12T15:11:56+01:00 DBG Flushing spooler because of timeout. Events flushed: 0

The config loads ok and now looks like this:

    multiline:
      pattern: "^\\s"
      match: after

I've tried it without quotes and it still complains...

5

have you tried single quotes ' ?

6

Yes I have. Both lead to the same error...

7

can you share your full filebeat.yml?

Plus, read the log message again:

2016-04-12T15:11:54+01:00 ERR Stop Harvesting. Unexpected encoding line reader error: error parsing regexp: invalid escape sequence: \s

It says \s itself is invalid, it is not saying it can not parse it. Use [[:space:]]. Also check out the docs