Beats Snippet - Single Line


(Jan) #1

Hi

I have set up a Beats Input to process a multiline log which is currently working. Only issue are the logs sometimes go over the multiline 500 line limit. I have tried to resolve by adding a snippet with the “max_lines: 2000” field but this does not work as it adds to the end of the generated filebeat.yml file (not in the “multiline:” section where it should be).

I thought maybe I could then create a snippet with the entire multiline: section with the following;

multiline:
max_lines: 2000
match: after
negate: true
pattern: Start Script STEP

Unfortunately this adds to the filebeat.yml file as a single line, so does not work.

Are there any newline characters etc that I need to add to make it work?

Thanks


(system) #2

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.