Multiline filter failure

Elastic Stack Beats
1

Hello,

I am trying to parse a log file in multiline format and each new linestarts with the date :

28-Sep-2020 18:26:19.982

I tried to configure the config as below :

filebeat.inputs:
- type: log
  tags: ["PROD_CATALINAOUT"]
  paths:
    - /catalina.out
  multiline.pattern: '^\%{MONTHDAY}'
  multiline.negate: true
  multiline.match: after

However, it does not seem to be working...I found that the entire log file has been written as a single entry...How do I fix this?

2

You should move this to the filebeat forum, it is not a logstash question.

3

Updated to Beats

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.