Problems using multiline configurations

[Hkh9966 (MajorTom)]

hello guys!
I would like to ask a question about multi-line merging. I tried to test using the example provided by the official, but it didn't work.This is the link : Manage multiline messages | Filebeat Reference [8.3] | Elastic .

I'll provide my runtime and configuration files:

• ENV: docker
• filebeat.yml:

filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /var/log/sleuthlog/*.log

filebeat.config:
  modules:
    path: ${path.config}/modules.d/*.yml
    reload.enabled: false

processors:
- add_cloud_metadata: ~
- add_docker_metadata: ~

multiline.type: pattern
multiline.pattern: '^\['
multiline.negate: true
multiline.match: after

output.console:
   pretty: true
   enable: true

Obviously, the console printed logs are not merged:

Looking forward to your reply, this is very important to me Thank you!

[Hkh9966 (MajorTom)]

Sorry , I forgot the filbeat version : 7.5.1

[mtojek (Marcin Tojek)]

There were many code changes since version 7.5.1. Have you tried to use the latest filebeat version?

[lzold_z]

Have you tried place the multiline like example below ?
because yaml files are very sensitive

- type: log
  enabled: true
  paths:
    - "path/to/monitor"
  multiline.type: pattern
  multiline.pattern: '^\['
  multiline.negate: true
  multiline.match: after

[Hkh9966 (MajorTom)]

I have tried the solution that you said, it works well, thanks!!