I'm trying to assign entries without timestamp to the previous ones that DO have timestamps, so they stick together when I perform search in Elasticsearch.
However, I haven't been successful at it.
This is my filebeat config:
multiline.pattern: '^\[0-9]{4}-[0-9]{2}-[0-9]{2}'
multiline.negate: true
multiline.match: after
and this is the log example I'm trying to perform this on:
2019-05-11 12:28:23,199 [24] ERROR TcpCommunication - StartControllerTcpServerAsync**
System.ObjectDisposedException: Cannot access a disposed object.**
Object name: 'System.Net.Sockets.Socket'.**
at System.Net.Sockets.Socket.EndAccept(IAsyncResult asyncResult)**
at System.Net.Sockets.TcpListener.EndAcceptTcpClient(IAsyncResult asyncResult)**
at System.Threading.Tasks.TaskFactory1.FromAsyncCoreLogic(IAsyncResult iar, Func`2 endFunction, Action1 endAction, Task1 promise, Boolean requiresSynchronization)**
--- End of stack trace from previous location where exception was thrown ---**
at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)**
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)**
at Docs4ECMApiCommon.Utils.TcpCommunication.d__20.MoveNext() in C:\ITS-GIT\ITS - IT Sistemi\ITSistemi.Docs4ECM.Api\Docs4ECMApiCommon\Utils\TcpCommunication.cs:line 127**
2019-05-11 12:28:23,199 [24] ERROR TcpCommunication - StartGuiTcpServerAsync**
What am I doing wrong?
Thanks