Multiline pattern with tab

Elastic Stack Beats
1

Hi!

I'd like to use multiline.pattern in filebeat input (in filebeat.yml) to process tomcat Java logs and send it to logstash+elasticsearch.

Below is a piece of the log file:

Apr 03, 2018 10:53:44 AM org.apache.catalina.core.StandardWrapperValve invoke
INFO: java.io.IOException: App computation error Error, invalid input: lhs received -5/3*x-4/3, which is not valid for its 1st argument, expr
at com.appsoft.server.router.AppServer.checkAppError(AppServer.java:421)
...

How can I instruct filebeat to include all lines starting with a tab as part of the single message?

2

If each line starting with a timestamp indicates the start of a new event (might be the case here) you can create a pattern this way. That link also provides a few different examples if that is not the case.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.