Hello guys,
I have two files on type log input in filebeat.yml. So, in first file, a have pattern multiline and another no have pattern becausa is single line.
Is possible use processor conditions to input use pattern multiline and another ignore pattern?
I could do this.
Is so simple
-
type: log
paths:
- '/log/log1'
encondig: utf-16be
fields:
fb-index: filebeat-apachewm
fields_under_root: true
multiline.pattern: 'pattern'
multiline.negate: true
multiline.match: after
-
type: log
paths:
- '/log/log2'
encondig: utf-16be
fields:
fb-index: filebeat-apachewm
system
(system)
Closed
March 29, 2019, 1:17pm
3
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.