I have this in a log file:
2016-05-24 08:39:14 18083 [Note] /usr/sbin/mysqld: ready for connections. Version: '5.6.29-76.2-log' socket: '/var/lib/mysql/mysql.sock' port: 3306 Percona Server (GPL), Release 76.2, Revision ddf26fe 2016-05-24 08:43:46 18083 [Note] /usr/sbin/mysqld: Normal shutdown
The second line belongs to the event started on the first line. I'm using this filebeat config:
filebeat: prospectors: - paths: - /var/log/mysql/error.log multiline: pattern: '[[:digit:]][[:digit:]][[:digit:]][[:digit:]]' negate: true match: after input_type: log document_type: mysql-error
When I look at the results in Elasticsearch I don't get what I expected. There are three events, one for each line. What I expected was that the second line will have been concatenated to the first line. Is this not what the multiline option is supposed to do?