Multiline max_lines not set

Elastic Stack Beats
1

Hi

I'm working on harvesting large csv files using multiline option and It looks like that default option of multiline.max_lines is not overriden by value set in filebeat.yml

When filebeat is parsing record which takes more than 500 lines he stops on 500th line and incomplete record is published to output.

I am using filebeat 5.1.2 in docker on ubuntu image

Here are configuration and results of parsing sample file: https://gist.github.com/mjasion/235768fb87a7f708264669af755bd23d
Published record should have all lines from 0001 to 999.

I also set multiline.timeout: 10s but result was same

2

looks like a typo: multiline.max_linex: 10000

3

You are right. :frowning: I focused on changing value...
Thanks @steffens and sorry for wasting time

Thread can be closed

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.