Multiline not combining lines - GO play matches

(Steph Van Schalkwyk) #1

[SOLVED] - multiline.* settings were not indented correctly.
Filebeats configtest did not pick this up.

I'm ingesting SOLR logs. The logs have a datetime stamp on the first line and the information on the second.

Date lines start with
"Oct 17, 2017 1:09:46 PM org.apache.solr.request.UnInvertedField uninvert" etc.

My match pattern is

The GO Play test is here:
Line 1 true
Line 2 false
Line 3 true.......
In filebeats.yml has negate: true, match: after

Any idea why Filebeats is not combining lines?

(Andrew Kroh) #2