Multiline logs

Elastic Stack Beats
1

In filebeat config:
multiline.type: pattern
multiline.pattern: '^['
multiline.negate: true
multiline.match: after
From Manage multiline messages | Filebeat Reference [7.14] | Elastic and test log
'''
[beat-logstash-some-name-832-2015.11.28] IndexNotFoundException[no such index]
at org.elasticsearch.cluster.metadata.IndexNameExpressionResolver$WildcardExpressionResolver.resolve(IndexNameExpressionResolver.java:566)
at org.elasticsearch.cluster.metadata.IndexNameExpressionResolver.concreteIndices(IndexNameExpressionResolver.java:133)
at org.elasticsearch.cluster.metadata.IndexNameExpressionResolver.concreteIndices(IndexNameExpressionResolver.java:77)
at org.elasticsearch.action.admin.indices.delete.TransportDeleteIndexAction.checkBlock(TransportDeleteIndexAction.java:75)
'''
In elastic each line other message. Filebeat: 7.14.0

2

It's not clear what you are asking for here sorry.

3

It's not clear what you are asking for here sorry. I took the config from the off site, and an example of the log. The example of the config itself, and the log sent in the subject.
But in ELK, they are different messages.
What could be the problem?

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.