Hi all, I’m using Graylog 4.1.6 and I’m using filebeat to send leg message into Graylog. My problem is how to configure fielbeat in order to send multiline messages. Consider a simple json text { "preview": false, "offset": 2491152, "result": { "_raw": "row message", "_time": "2022…

Hi, finally I solve it I just add the configuration from filebeat.inputs: filebeat.inputs: - type: log enabled: true paths: - C:/splunk-logs/aad-test/test.json # Multiline https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html multiline.type: pattern multiline…

You can handle that in your configuration here are the docs from Elasticsearch on filebeat->multiline I found a random example of the multiline commands being used here … that post doesn’t solve the problem is is just an example of multiline processing in the sidecar configuration.

Adding on to @tmacgbay , I also found another example. This post did look familiar. Filebeat Windows - Java Multiline Pattern

Hi @gsmith @tmacgbay thanks a lot for your help I’m going to solve my scenario and I will share the solution here hoping that could help someone in the future Thanks

Hi all I tested { "test": true } using the configuration below: multiline.pattern: '^\{' multiline.negate: true multiline.match: after as suggested here but it does not works. I tested multiline.pattern: ‘^{’ too without result. The json is splitted in more then one message [image] Any sug…

Your post and it’s edit conflict in what your multiline pattern settings are, as I read it the top one where it says this: multiline.pattern: '^\{' multiline.negate: true multiline.match: after should work the way that you want. The other important thing to note is that yml configuration files ar…

Mark it as solved for future searchers! :smiley:

FileBeat multiline How to

Graylog Central (peer support)

gsmith (GSmith) June 28, 2022, 11:47pm 3

Adding on to @tmacgbay , I also found another example. This post did look familiar.

Filebeat Windows - Java Multiline Pattern

Topic		Replies	Views
Filebeat multiline in Graylog 3 Graylog Central (peer support) sidecar , filebeat-windows , winlogbeat	5	1779	March 28, 2019
Multi-Line with Beats Input Graylog Central (peer support) sidecar , filebeat-linux	10	10368	July 24, 2017
Filebeat Multiline not combining lines Graylog Central (peer support) sidecar , filebeat-linux	9	1569	March 30, 2023
Sidecar Multiline config Graylog Central (peer support) sidecar	4	2909	July 26, 2019
Filebeat multiline option Graylog Central (peer support)	2	604	July 23, 2019

FileBeat multiline How to

Related topics