Exclude JSON logs from multiline matching

elastic · May 13, 2020 · db8f990 · db8f990
1 parent 7b33c05
commit db8f990
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 4 deletions.
diff --git a/filebeat/module/logstash/log/config/log.yml b/filebeat/module/logstash/log/config/log.yml
@@ -5,12 +5,10 @@ paths:
 {{ end }}
 exclude_files: [".gz$"]
 
-{{ if eq .format "plain" }}
 multiline:
-  pattern: ^\[[0-9]{4}-[0-9]{2}-[0-9]{2}
+  pattern: ^(\[[0-9]{4}-[0-9]{2}-[0-9]{2}|{)
   negate: true
   match: after
-{{ end }}
 
 processors:
 # Locale for time zone is only needed in non-json logs

diff --git a/filebeat/module/logstash/log/test/logstash-plain-7.4.log-expected.json b/filebeat/module/logstash/log/test/logstash-plain-7.4.log-expected.json
@@ -31,4 +31,4 @@
         "message": "Encountered a retryable error. Will Retry with exponential backoff...",
         "service.type": "logstash"
     }
-]
+]