Multiline handling

[jhmartin]

This would be a neat way to handle multiline in a docker environment by wrapping apps that are not logstash-aware in this beat, handling multiline and sending the results on to Docker. Please consider integrating something equivalent to the multiline plugin.

[christiangalsterer]

I'm afraid that I didn't fully understand yet your request/question. Can you please provide some more examples, description?

[jhmartin]

Certainly. Some security policies promote running containers in read-only mode, and enforcing all logging be to STDOUT. Filebeat therefor doesn't have a file to read. Execbeat would let me wrap an application such that STDOUT of the application goes into execbeat to be sent on to Logstash. However, apps like Java love to print multiline messages that are one logical message (stack traces for example), so if Execbeat handled multiline-collapsing then it'd be very attractive for this use.

[christiangalsterer]

Thanks for the feedback. If I understood it correctly you would like to use exec beat to start a (java) app which logs to STDOUT and then send the STDOUT to the configured output including that a single event is formed over multiple lines. Is this correct?

[jhmartin]

@christiangalsterer That is exactly it.

[jhmartin]

Any further thoughts on this?