I have been working on getting a configuration that works with filebeat going again and have been trying to change the line delimiter so I could avoid doing the multiline crap. I first configured eventDelimiter=“\f” since filebeat supports that as a replacement for newline. Except no matter how hard I tried I couldn’t get filebeat to log anything to stdout.
I spent hours looking at it before I finally realized that the logs being written actually had “\f” in the string instead of a form feed character. It seems that XML must be passing in the value treating the “\” as if it is escaped. To remedy this the only solution I could come up with was <JsonTemplateLayout eventTemplateUri="classpath:template.json" locationInfoEnabled="true"> <eventDelimiter>…</eventDelimiter> </JsonTemplateLayout> It seems that XML doesn’t allow a form feed character specified that way. This caused filebeat to start recognizing the log events. I would suggest that we may want to change eventDelimiter to accept enum names instead of or in addition to characters, which is what filebeat does. So one could specify eventDelimiter=“Form Feed”. Ralph