From 156f4012e3f174ad52547ca14683d6d7f68896e9 Mon Sep 17 00:00:00 2001
From: pengln <pengln@amonstack.com>
Date: Wed, 29 Dec 2021 18:09:04 +0800
Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=20filebeat=20=E5=A4=9A?=
 =?UTF-8?q?=E8=A1=8C=E6=97=A5=E5=BF=97=E6=8E=A8=E9=80=81Grok=E5=A4=B1?=
 =?UTF-8?q?=E8=B4=A5=E7=9A=84=E9=97=AE=E9=A2=98?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 playbooks/roles/filebeat/defaults/main.yml      | 1 +
 playbooks/roles/filebeat/templates/filebeat.yml | 7 +++++++
 2 files changed, 8 insertions(+)

diff --git a/playbooks/roles/filebeat/defaults/main.yml b/playbooks/roles/filebeat/defaults/main.yml
index 9d5215b..b96dcb9 100644
--- a/playbooks/roles/filebeat/defaults/main.yml
+++ b/playbooks/roles/filebeat/defaults/main.yml
@@ -34,6 +34,7 @@ filebeat_logs:
     index_prefix: "mgr"
     template_name: "mgr-cp"
     template_pattern: "mgr-*"
+    multiline: true
     sublog: cp
     filebeat_older_dir: "/data/opt/filebeat/{{ instance_name }}"
     filebeat_older_data_dir: data2
diff --git a/playbooks/roles/filebeat/templates/filebeat.yml b/playbooks/roles/filebeat/templates/filebeat.yml
index 4aa07b2..fa5e4a3 100644
--- a/playbooks/roles/filebeat/templates/filebeat.yml
+++ b/playbooks/roles/filebeat/templates/filebeat.yml
@@ -10,6 +10,13 @@ filebeat.inputs:
   {% if "exclude_files" in logs[log_type] -%}
   exclude_files: {{ logs[log_type]['exclude_files'] }}
   {% endif -%}
+  {% if logs[log_type]['multiline'] -%}
+  multiline.type: pattern
+  multiline.pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}'
+  multiline.negate: true
+  multiline.match: after
+  multiline.skip_newline: true
+  {% endif -%}
   harvester_buffer_size: 2048
   ignore_older: {{ filebeat_older }}
   tail_files: {{ filebeat_tail_files | string | lower }}