[SOLVED] - multiline.* settings were not indented correctly.
Filebeats configtest did not pick this up.
I'm ingesting SOLR logs. The logs have a datetime stamp on the first line and the information on the second.
Date lines start with
"Oct 17, 2017 1:09:46 PM org.apache.solr.request.UnInvertedField uninvert" etc.
My match pattern is
The GO Play test is here:
Line 1 true
Line 2 false
Line 3 true.......
In filebeats.yml has negate: true, match: after
Any idea why Filebeats is not combining lines?