So im trying to have filebeat send the entire log file as one event instead of every line as an event, but its not working, this is my filebeat setup:
multiline.pattern: ^\[ multiline.negate: true multiline.match: after
and this is an example of a log file that i have:
2020-02-03 16:03:25,038 INFO Initial blacklisted packages: 2020-02-03 16:03:25,039 INFO Initial whitelisted packages: 2020-02-03 16:03:25,039 INFO Starting unattended upgrades script
but filebeat sends every line as an event, i need to send the whole thing as one event instead of seperated.
Any idea of what im doing wrong here?
Thanks in advance for any help!