Merge pull request '修复 filebeat 多行日志推送Grok失败的问题' (#56) from pengln/filebeat:master into master

Reviewed-on: https://app.huanyuantech.com:10301/gitea/ansible-collection/filebeat/pulls/56

playbooks/roles/filebeat/defaults/main.yml

@@ -34,6 +34,7 @@ filebeat_logs:
     index_prefix: "mgr"
     template_name: "mgr-cp"
     template_pattern: "mgr-*"
+    multiline: true
     sublog: cp
     filebeat_older_dir: "/data/opt/filebeat/{{ instance_name }}"
     filebeat_older_data_dir: data2

playbooks/roles/filebeat/templates/filebeat.yml

@@ -10,6 +10,13 @@ filebeat.inputs:
   {% if "exclude_files" in logs[log_type] -%}
   exclude_files: {{ logs[log_type]['exclude_files'] }}
   {% endif -%}
+  {% if logs[log_type]['multiline'] -%}
+  multiline.type: pattern
+  multiline.pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}'
+  multiline.negate: true
+  multiline.match: after
+  multiline.skip_newline: true
+  {% endif -%}
   harvester_buffer_size: 2048
   ignore_older: {{ filebeat_older }}
   tail_files: {{ filebeat_tail_files | string | lower }}