I have been following this thread for a few days. I was having a hell of a time getting the FileBeats pattern to work with Logstash. I discovered that for some reason the ^ character in the pattern isn't keying on the first character in a line.... but rather the first character in a file. Which would seem to be a ridiculous implementation of a new line regex character.
Am I missing something? I stopped using the ^ and now I am getting logs to group together (success!)... but now there are several stack traces being appended to the same message.
Is this a known behavior? Or am I doing something wrong?
I am using SLF4J logs with the log4j input type in FileBeats.