I have been working on getting a configuration that works with filebeat going 
again and have been 
trying to change the line delimiter so I could avoid doing the multiline crap. 
I first configured 
eventDelimiter=“\f” since filebeat supports that as a replacement for newline. 
Except no matter 
how hard I tried I couldn’t get filebeat to log anything to stdout. 

I spent hours looking at it before I finally realized that the logs being 
written actually had “\f” in 
the string instead of a form feed character. It seems that XML must be passing 
in the value 
treating the “\” as if it is escaped.  To remedy this the only solution I could 
come up with was

<JsonTemplateLayout eventTemplateUri="classpath:template.json" 
locationInfoEnabled="true">
  <eventDelimiter>&#x0085;</eventDelimiter>
</JsonTemplateLayout>
It seems that XML doesn’t allow a form feed character specified that way. This 
caused filebeat
to start recognizing the log events.  I would suggest that we may want to 
change eventDelimiter 
to accept enum names instead of or in addition to characters, which is what 
filebeat does. So 
one could specify eventDelimiter=“Form Feed”.

Ralph

Reply via email to