Hi
I have set up a Beats Input to process a multiline log which is currently working. Only issue are the logs sometimes go over the multiline 500 line limit. I have tried to resolve by adding a snippet with the “max_lines: 2000” field but this does not work as it adds to the end of the generated filebeat.yml file (not in the “multiline:” section where it should be).
I thought maybe I could then create a snippet with the entire multiline: section with the following;
multiline:
max_lines: 2000
match: after
negate: true
pattern: Start Script STEP
Unfortunately this adds to the filebeat.yml file as a single line, so does not work.
Are there any newline characters etc that I need to add to make it work?
Thanks