合并多行以[为头

multiline:

pattern: '^\['

negate: true

match: after

------------------------------------------------

过滤掉某行

exclude_lines: ['^#'] ----------------------------

# cat filebeat.ymlfilebeat.prospectors:- type: log  paths:    - /data/log/tomcat/localhost_access_log.*.txt  exclude_lines: ['^#']  fields:    tag: accesslog-121- type: log  paths:    - /data/log/tomcat/catalina.out  exclude_lines: ['^#']  fields:    tag: catalina-121filebeat.config.modules:  path: ${path.config}/modules.d/*.yml  reload.enabled: true  output.redis:  hosts: ["127.0.0.1"]  port: 6380  key: "tomcat121-autoschedulecore-access-list" -------------------------------- 包含某行

filebeat.prospectors:- input_type: log  paths:    - /tmp/test.log  include_lines: [‘error‘]

 

 

---------------------------------------------------------------------------------------------------

filebeat.prospectors:

- type: log

paths:

- /ali/logs/*.out

multiline:

pattern: '^\['

negate: true

match: after

fields:

tag: log1

- type: log

paths:

- /ali/logs/*.conf

fields:

tag: log2

filebeat.config.modules:

path: ${path.config}/modules.d/*.yml

reload.enabled: false

output.redis:

hosts: ["127.0.0.1"]

port: 6380

key: "test-list"