Multiline log reading problem

[ilkerb]

Hi all,

I’m trying to read multiline log files from another application server by Sidecar.
But I can’t read the last line.

Here is my Filebeat Multiline Pattern:

multiline.pattern: '^HELPDESK'
multiline.negate: true
multiline.match: after

Here is example log:

HELPDESK | 13-12-2019 08:20:30.841 | ilkerb | HOSTNAME | [73] | ERROR | HelpDesk.Operation.LoggerService | System.Web.HttpException (0x80004005): The controller for path '/favicon.ico' was not found or does not implement IController.
   at System.Web.Mvc.DefaultControllerFactory.GetControllerInstance(RequestContext requestContext, Type controllerType)
   at System.Web.Mvc.DefaultControllerFactory.CreateController(RequestContext requestContext, String controllerName)
   at System.Web.Mvc.MvcHandler.ProcessRequestInit(HttpContextBase httpContext, IController& controller, IControllerFactory& factory)
   at System.Web.Mvc.MvcHandler.BeginProcessRequest(HttpContextBase httpContext, AsyncCallback callback, Object state)
   at System.Web.Mvc.MvcHandler.BeginProcessRequest(HttpContext httpContext, AsyncCallback callback, Object state)
   at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
   at System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep step)
   at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)

This is tokenizer which is used to format the logs:

tokenizer: "%{source} | %{logtime} | %{username} | %{hostname} | %{thread} | %{loglevel} | %{class} | %{message}"

Here is screenshot about problem:

[jan (Jan Doberstein)]

what exactly is the problem?

[ilkerb]

Sidecar can’t read the last line of the log. It is forwarded like a seperate log as unknown.