filebeat配置接收多行信息

filebeat.yml

  multiline.pattern: ^\s+
  # multiline.pattern: "^\["
  # Defines if the pattern set under pattern should be negated or not. Default is false.
multiline.negate: false
  # multiline.negate: true
  # Match can be set to "after" or "before". It is used to define if lines should be append to a pattern
  # that was (not) matched before or after or as long as a pattern is not matched based on negate.
  # Note: After is the equivalent to previous and before is the equivalent to to next in Logstash
multiline.match: after

pattern: 匹配识别多行  ^\s+  以空格开头的行为子行
negate: 判断类型 true 好像只匹配一次
match:  after将子行归在前面的event