Multiline log in elastic agent

Elastic Stack Beats
1

Hi, i have a filebeat that picks up a file in the log directory and parses it with the multiline options in the filebeath.yml file:

Multiline options

multiline.type: pattern
multiline.pattern: '[0-9]{4}-[0-9]{2}-[0-9]{2}'
multiline.negate: true
multiline.match: after

How can i do this with the elastic agent. Under the release notes there is a line item that says that elastic agent does not support multiline at the moment, however is there anything that can be added to the elastic-agent.yml file directly to do this? Any other options to get this to work someohow with elastic agent?

Thank you

2

it depends if you're running agent as a standalone or managed by fleet.
standalone gives you more options in regards of input, so it should be able to add multiline fields into log input section and this will be send to filebeat.
if it is managed by fleet you can create policy Custom logs integrations which in Advanced options enables you to provide some yaml config part. this is where you place multiline settings.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.