Struggling with Multiline

Elastic Stack Beats
4

Hi @andrewkroh, @steffens,

Many thanks for your help.
Yes, as describe in the logback, the log message always start with a [Thread-ID] %DATE

Well, I'm trying to adapt my previous logstash config (which is working with multilines) to use the ingest node feature. (I'm using elk 5.6.4)

I've tried to set the pattern to ^\[Thread-\d+\] but I get the same result. Only the first line is inserted into elastic.

Maybe as useful information (encoding is utf-8 & carriage return is $):

file -bi /tmp/multiline.log 
text/plain; charset=utf-8

and

vi /tmp/multiline.log --> :set list
        [...]
        at com.ibm.msg.client.wmq.common.internal.Reason.createException(Reason.java:204)$
        ... 16 common frames omitted$