I have a log with an interesting format where it has a timestamp on one line and then the message on the next line. I am trying to use Filebeat's multiline to combine the line with the timestamp and the following line with the message into one event.
The timestamp looks like this:
Wed Jan 30 10:35:51 2019
My Filebeat has these options:
multiline.pattern: '^\w{3} \w{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}'
multiline.negate: false
multiline.match: before
At run time, there are no multiline events in the index, and in fact there are no events that match the timestamp pattern being sent at all (is it tossing them out?). I suspect that multiline only works with 2 or more lines matching the pattern, but documentation doesn't state this.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.