Filebeat multiline pattern

Question

enter image description here

In the picture stacktrace of log message taking the new log line I want them in one log. How to do that ? Here is my pattern

  multiline.pattern: '^[[:space:]]'
  multiline.negate: false
  multiline.match: after
  

Answer 1

From the log sample provided in the screenshot, seems like each new event is starting with date so a multiline pattern like below should work.

multiline.type: pattern
multiline.pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}'
multiline.negate: true
multiline.match: after

I have previously done a similar thing for ingesting IBM BPM System logs and had to increase multiline.max_lines to 1000 as the default 500 was not sufficient for getting the entire stack trace ingested.