Multiline pattern not working in my filebeat configuration

Elastic Stack Beats
1 
Hi ,

I am using below multiline option in my filebeat.yml file.

multiline.pattern: '^[[:space:]]+(at|.{3})\b|^Caused by:'
multiline.negate: false
multiline.match: afterPreformatted text

but the logs are still printing in different lines in kibana.

Logs:-

Exception in thread "main" java.lang.IllegalStateException: A book has a null property
at com.example.myproject.Author.getBookIds(Author.java:38)
at com.example.myproject.Bootstrap.main(Bootstrap.java:14)
Caused by: java.lang.NullPointerException
at com.example.myproject.Book.getId(Book.java:22)
at com.example.myproject.Author.getBookIds(Author.java:35)
... 1 more

Kibana snap:-

image
image940×306 29.9 KB

please help resolve.

2

Hi,

I don't know if this helps but we use the follwoing config for Java Logs:
multiline.pattern: ^\d?\d.\d\d.\d\d
multiline.negate: true
multiline.match: after

Where the pattern is the date format for the logs. This way, all lines starting with a date are separate entries while any other lines(like stacktraces) are appended to the previous entry.

Best regards
Wolfram