Filebeat Process multilne XML

Question

I have a log file where I am printing request and response XML bodies. This log file also has some additional lines that are not XML. Example below --

===========================================
<request>
  <data>
    abc
 </data>
</request>
some random lines concerning the processing of request..
fha;js;fkgak;gj;kj;a
jgahkg;gaj;
Now response follows 
<response>
 <output>
  def
</output>
</response>
===================================================

How to use use filebeat multiline feature to parse such a data and have each XML as a single event to be sent to logstash?

Answer 1

multiline.pattern: ^<request> multiline.negate : true multiline.match : after

you need to insert above mentioned line in filebeat.yml file this will capture all your data lying between as a single event beginning with <request> before the next <request> is found.you can modify your multipline.pattern(regex expression) as per your requirement.

for a detailed information check out following link: https://www.elastic.co/guide/en/beats/filebeat/1.2/configuration-filebeat-options.html