We have the problem that all logs which are send from our Squid server over Filebeat with the Squid module are combined as single messages in Kibana.
The message contains 5 up to 15 entrys which are in fact single log lines from the Squid server.
The squid server is using the default log output format, but we tried different formats with no solution.
> %ts.%03tu %6tr %>a %Ss/%03>Hs %<st %rm %ru %[un %Sh/%<a %mt
Example of log, IP changed to 0.0.0.0:
> 1607961779.062 7 0.0.0.0 TCP_MISS/206 5004 GET http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/xxxx? - HIER_DIRECT/0.0.0.0 application/octet-stream
We are NOT using any "multiline" options, just the default filebeat configuration with the Squid module which shipps everything directly to ES.
We also tried to ship the logs from Squid to logstash but didn't find a solution for the multiple entries. And we want to use the Squid module at the end.
Is there a more precise guide for the squid settings than this one:
Similar asked here:
Moreover the filebeat syslog is full of this type of error messages:
This errors are in fact from the Squid module, of course not when using logstash.
Example of the multiple logs per entry: