Multi-line logs into ES from filebeat deployed as Kubernetes Daemonset

Finally able to solve the issue, use Multi-line filter under filebeat.autodiscover:

      filebeat.autodiscover:      providers:        - type: kubernetes          templates:            - condition:                or:                  - equals:                      kubernetes.container.name: car-search                  - equals:                      kubernetes.container.name: cart-service              config:                - type: docker                  containers.ids:                    - "${data.kubernetes.container.id}"                  multiline.pattern: '^[[:space:]]'                  multiline.negate: false                  multiline.match: after    processors:      - add_cloud_metadata:

ref https://github.com/moby/moby/issues/22920

You can try the following:

filebeat.inputs:- type: container  multiline.pattern: '<your-pattern>'  multiline.negate: false  multiline.match: after  paths:    - /var/log/containers/*.log  processors:    - add_kubernetes_metadata:        in_cluster: true        host: ${NODE_NAME}        matchers:        - logs_path:            logs_path: "/var/log/containers/"