Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[7.x](backport #26786) Clarify the scope of start/end multiline example #26924

Merged
merged 1 commit into from
Jul 16, 2021
Merged

[7.x](backport #26786) Clarify the scope of start/end multiline example #26924

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 15 additions & 1 deletion filebeat/docs/multiline.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -220,6 +220,21 @@ multiline.flush_pattern: 'End event'

The `flush_pattern` option, specifies a regex at which the current multiline will be flushed. If you think of the `pattern` option specifying the beginning of an event, the `flush_pattern` option will specify the end or last line of the event.

NOTE: This example will not work correctly if start/end log blocks are mixed with non-multiline logs, or if different start/end log blocks overlap with each other. For instance, `Some other log` log lines in the following example will be merged into a _single_ multiline document because they neither match `multiline.pattern` nor `multiline.flush_pattern`, and `multiline.negate` is set to `true`.

[source,shell]
-------------------------------------------------------------------------------------
[2015-08-24 11:49:14,389] Start new event
[2015-08-24 11:49:14,395] Content of processing something
[2015-08-24 11:49:14,399] End event
[2015-08-24 11:50:14,389] Some other log
[2015-08-24 11:50:14,395] Some other log
[2015-08-24 11:50:14,399] Some other log
[2015-08-24 11:51:14,389] Start new event
[2015-08-24 11:51:14,395] Content of processing something
[2015-08-24 11:51:14,399] End event
-------------------------------------------------------------------------------------

==== Test your regexp pattern for multiline

To make it easier for you to test the regexp patterns in your multiline config, we've created a
Expand All @@ -229,4 +244,3 @@ Then click Run, and you'll see which lines in the message match your specified c

image:images/go-playground.png[]