Skip to content

Commit

Permalink
Clarify the scope of start/end multiline example (#26786) (#26924)
Browse files Browse the repository at this point in the history
* Clarify the scope of start/end multiline example

The example in `Applicaton events` section does not clarify the usability scope.
I'm adding clarification with an example.

* Update filebeat/docs/multiline.asciidoc

Co-authored-by: DeDe Morton <dede.morton@elastic.co>
  • Loading branch information
gbanasiak and dedemorton authored Jul 16, 2021
1 parent 2081a18 commit f17904d
Showing 1 changed file with 15 additions and 1 deletion.
16 changes: 15 additions & 1 deletion filebeat/docs/multiline.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -220,6 +220,21 @@ multiline.flush_pattern: 'End event'

The `flush_pattern` option, specifies a regex at which the current multiline will be flushed. If you think of the `pattern` option specifying the beginning of an event, the `flush_pattern` option will specify the end or last line of the event.

NOTE: This example will not work correctly if start/end log blocks are mixed with non-multiline logs, or if different start/end log blocks overlap with each other. For instance, `Some other log` log lines in the following example will be merged into a _single_ multiline document because they neither match `multiline.pattern` nor `multiline.flush_pattern`, and `multiline.negate` is set to `true`.

[source,shell]
-------------------------------------------------------------------------------------
[2015-08-24 11:49:14,389] Start new event
[2015-08-24 11:49:14,395] Content of processing something
[2015-08-24 11:49:14,399] End event
[2015-08-24 11:50:14,389] Some other log
[2015-08-24 11:50:14,395] Some other log
[2015-08-24 11:50:14,399] Some other log
[2015-08-24 11:51:14,389] Start new event
[2015-08-24 11:51:14,395] Content of processing something
[2015-08-24 11:51:14,399] End event
-------------------------------------------------------------------------------------

==== Test your regexp pattern for multiline

To make it easier for you to test the regexp patterns in your multiline config, we've created a
Expand All @@ -229,4 +244,3 @@ Then click Run, and you'll see which lines in the message match your specified c

image:images/go-playground.png[]


0 comments on commit f17904d

Please sign in to comment.