Shipping whole file as message?

Elastic Stack Beats
4

I guess I have a solution.
I don't have to detect the last line. Seems for me, that filebeat detects it itself. Only have to be sure to start at first line and put everything on it.
filebeat.yml

filebeat.prospectors: 
- input_type: log
      paths:
        - /X/Y/*/*
      multiline.pattern: ' \A.*'
      multiline.negate: true
      multiline.match: after
      tags: ["my-tag"]
1 Like