Filebeat收集java多行匹配模式日志

1.修改Filebeat配置文件

cat >/etc/filebeat/filebeat.yml<<EOF 
filebeat.inputs:
- type: log
enabled: true
paths:
- /var/log/Elasticsearch/elasticsearch.log
multiline.pattern: '^\['
multiline.negate: true
multiline.match: after

output.elasticsearch:
hosts: ["10.0.0.51:9200"]
index: "es-%{[beat.version]}-%{+yyyy.MM}"
setup.template.name: "es"
setup.template.pattern: "es-*"
setup.template.enabled: false
setup.template.overwrite: true
EOF

systemctl restart filebeat

2.模拟报错

3.es-head插件已经能收到新数据

4.在kibana删除原来的索引，重新添加

5.查看效果