Filebeat multiline parsing of Java exception in docker container not working
Stumbled over this problem today as well.
This is working for me (filebeat.yml):
filebeat.prospectors:- type: log multiline.pattern: "^[[:space:]]+(at|\\.{3})\\b|^Caused by:" multiline.negate: false multiline.match: after paths: - '/var/lib/docker/containers/*/*.log' json.message_key: log json.keys_under_root: true processors: - add_docker_metadata: ~output.elasticsearch: hosts: ["es-client.es-cluster:9200"]I use Filebeat 6.2.2 to send the Logs directly to Elasticsearch