CODEWITHSUNDEEP
elasticsearchlogstashfilebeat
Bhavin Varsur
Bhavin Varsur

Reputation: 327

Filebeat multiline pattern

enter image description here

In the picture stacktrace of log message taking the new log line I want them in one log. How to do that ? Here is my pattern

  multiline.pattern: '^[[:space:]]'
  multiline.negate: false
  multiline.match: after

Upvotes: 1

Views: 2001

Answers (1)

karan shah
karan shah

Reputation: 370

From the log sample provided in the screenshot, seems like each new event is starting with date so a multiline pattern like below should work.

multiline.type: pattern
multiline.pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}'
multiline.negate: true
multiline.match: after

I have previously done a similar thing for ingesting IBM BPM System logs and had to increase multiline.max_lines to 1000 as the default 500 was not sufficient for getting the entire stack trace ingested.

Upvotes: 1

Related Questions