The indentation is incorrect. The multiline options are members of the prospector config so they need to be at the same level as input_type
and paths
.
filebeat.prospectors:
- input_type: log
paths:
- /var/log/radius/radacct/*/detail-*
multiline.pattern: '^\t+.*$'
multiline.negate: false
multiline.match: after
document_type: radiusdetail # You might want this option instead of using fields.