Multiline pattern not working in my filebeat configuration

Hi ,

I am using below multiline option in my filebeat.yml file.

multiline.pattern: '^[[:space:]]+(at|.{3})\b|^Caused by:'
multiline.negate: false
multiline.match: afterPreformatted text

but the logs are still printing in different lines in kibana.

Logs:-

Exception in thread "main" java.lang.IllegalStateException: A book has a null property
at com.example.myproject.Author.getBookIds(Author.java:38)
at com.example.myproject.Bootstrap.main(Bootstrap.java:14)
Caused by: java.lang.NullPointerException
at com.example.myproject.Book.getId(Book.java:22)
at com.example.myproject.Author.getBookIds(Author.java:35)
... 1 more

Kibana snap:-

please help resolve.

Hi,

I don't know if this helps but we use the follwoing config for Java Logs:
multiline.pattern: ^\d?\d.\d\d.\d\d
multiline.negate: true
multiline.match: after

Where the pattern is the date format for the logs. This way, all lines starting with a date are separate entries while any other lines(like stacktraces) are appended to the previous entry.

Best regards
Wolfram

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.