I've followed Filebeat multiline regexp patterns help which uses the following pattern:
multiline.pattern: ^\d\d\d\d-\d\d-\d\d
multiline.negate: true
multiline.match: after
which I'm testing on: https://play.golang.org/p/IZagant7bJN
Which passes. I still see in the logfiles the following
{
"@timestamp": "2020-04-14T09:24:07.385Z",
"@metadata": {
"beat": "filebeat",
"type": "_doc",
"version": "7.6.2"
},
"host": {
"name": "iws-02"
},
"agent": {
"hostname": "iws-02",
"id": "7c3b9efe-6ddb-4fac-99b9-b47855873fd1",
"version": "7.6.2",
"type": "filebeat",
"ephemeral_id": "402e53ea-fb3e-4e82-b90a-519fe7913122"
},
"log": {
"offset": 25105,
"file": {
"path": "/srv/iws/logs/iws-connector-config-service/iws-connector-config-webservice.log"
}
},
"message": "2020-04-14 09:23:57.417 ERROR 1 --- [elastic-1358] s.ConnectorConfigServiceExceptionHandler : Exception handled",
"input": {
"type": "log"
},
"ecs": {
"version": "1.4.0"
}
}
{
"@timestamp": "2020-04-14T09:24:07.386Z",
"@metadata": {
"beat": "filebeat",
"type": "_doc",
"version": "7.6.2"
},
"agent": {
"hostname": "iws-02",
"id": "7c3b9efe-6ddb-4fac-99b9-b47855873fd1",
"version": "7.6.2",
"type": "filebeat",
"ephemeral_id": "402e53ea-fb3e-4e82-b90a-519fe7913122"
},
"log": {
"file": {
"path": "/srv/iws/logs/iws-connector-config-service/iws-connector-config-webservice.log"
},
"offset": 25218
},
"message": "com.itembase.iws.connector.config.ConnectorConfigNotFoundException: Requested configuration was not found",
"input": {
"type": "log"
},
"ecs": {
"version": "1.4.0"
},
"host": {
"name": "iws-02"
}
}
{
"@timestamp": "2020-04-14T09:24:07.386Z",
"@metadata": {
"beat": "filebeat",
"type": "_doc",
"version": "7.6.2"
},
"input": {
"type": "log"
},
"ecs": {
"version": "1.4.0"
},
"host": {
"name": "iws-02"
},
"agent": {
"hostname": "iws-02",
"id": "7c3b9efe-6ddb-4fac-99b9-b47855873fd1",
"version": "7.6.2",
"type": "filebeat",
"ephemeral_id": "402e53ea-fb3e-4e82-b90a-519fe7913122"
},
"log": {
"offset": 25324,
"file": {
"path": "/srv/iws/logs/iws-connector-config-service/iws-connector-config-webservice.log"
}
},
"message": "\tat com.itembase.iws.connector.config.webservice.connection.ConnectionEntityService.getById(ConnectionEntityService.java:80) ~[classes/:na]"
}
...
So it's still not aggregated in one message but splitted across a lot of events.
I really don't understand what's wrong here.