Understanding Multiline

The indentation is incorrect. The multiline options are members of the prospector config so they need to be at the same level as input_type and paths.

filebeat.prospectors:
- input_type: log
  paths:
    - /var/log/radius/radacct/*/detail-*
  multiline.pattern: '^\t+.*$'
  multiline.negate: false
  multiline.match: after
  document_type: radiusdetail # You might want this option instead of using fields.