I have a log:
server.name 2021-03-28 10:03:28.648 INFO ...
---------------------------
ID: 3974
Address: https://www...
Encoding: UTF-8
Http-Method: POST
Content-Type: text/xml
Headers: {Accept=[*/*], ...
Payload: <soap:Envelope...
I want filebeat to read this log as multiline event as so:
server.name 2021-03-28 10:03:28.648 INFO ...
Payload: <soap:Envelope...
---, ID, Address, Encoding, Http-Method, Content-Type, Headers should be excluded. I tried following config in filebeat.yml unsuccessfully :
- type: log
enabled: true
paths:
- "/var/log/app_servers/liferay-ext.log"
- "/var/log/app_servers/liferay-int.log"
fields :
log_type: "logserver_prod_vrklt_liferay"
exclude_lines: ['---','ID:','Address:','Encoding:','Http-Method:','Content-Type:','Headers:']
multiline.pattern: ^\server.name
multiline.match: after
multiline.flush.pattern: 'Payload: '
Any ideas on how to get my desired result?