I am new to Kubernetes and Filebeat, but I am trying to modify our ELK stack running on Kubernetes sot that it picks up multiline logs from spring boot java applications. Here is the original configuration.
filebeat.autodiscover:
providers:
- type: kubernetes
hints.enabled: true
Here is the configuration that I tried. I tried to pick up lines that did not start with a date as being part of the line under them, but the Filebeat does not appear to be registering this config.
filebeat.autodiscover:
providers:
- type: kubernetes
hints.enabled: true
templates:
- condition:
contains:
kubernetes.namespace: "mynamespace"
conifg:
multiline.pattern: '[0-9]{4}-[0-9]{2}-[0-9]{2}'
multiline.negate: true
multiline.match: after
I am sure it is something obvious that I am missing, but does anyone know what I am doing wrong with the config?