Skip_newline no effect in filestream parsers.multiline

Elastic Stack Beats
,
1

Context:

Filebeat settings:

filebeat.inputs:
- type: filestream
  enabled: true
  paths:
  - /usr/var/log/foo.log
  parsers:
  - multiline:
      type: pattern
      pattern: '^[[:space:]]+(at|\.{3})[[:space:]]+|^(Caused|Wrapped) by:'
      negate: false
      match: after
      skip_newline: false

filebeat.config:
  modules:
    path: ${path.config}/modules.d/*.yml
    reload.enabled: false

output.kafka:
  # initial brokers for reading cluster metadata
  hosts:
  - 'localhost:9092'

Java stacktrace is recognised and brought into one line, but the concatenation drops line breaks and makes the resulting message not easily readable. Switching skip_newline off or being left out doesn't help, although the documentation says it controls the concatenation behavior.

2

Could you please share example events and expected outputs?

3

False alarm: the line breaks are there. It was just the viewer we used didn't display them. You can close this one now.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.