diff --git a/filebeat/docs/images/false-after-multi.png b/filebeat/docs/images/false-after-multi.png new file mode 100644 index 000000000000..1918c531d239 Binary files /dev/null and b/filebeat/docs/images/false-after-multi.png differ diff --git a/filebeat/docs/images/false-before-multi.png b/filebeat/docs/images/false-before-multi.png new file mode 100644 index 000000000000..ecb949b77ae0 Binary files /dev/null and b/filebeat/docs/images/false-before-multi.png differ diff --git a/filebeat/docs/images/true-after-multi.png b/filebeat/docs/images/true-after-multi.png new file mode 100644 index 000000000000..a77af69d974a Binary files /dev/null and b/filebeat/docs/images/true-after-multi.png differ diff --git a/filebeat/docs/images/true-before-multi.png b/filebeat/docs/images/true-before-multi.png new file mode 100644 index 000000000000..dc6bfcafbe9f Binary files /dev/null and b/filebeat/docs/images/true-before-multi.png differ diff --git a/filebeat/docs/reference/configuration/filebeat-options.asciidoc b/filebeat/docs/reference/configuration/filebeat-options.asciidoc index 440b35cc9d53..216ca40b5021 100644 --- a/filebeat/docs/reference/configuration/filebeat-options.asciidoc +++ b/filebeat/docs/reference/configuration/filebeat-options.asciidoc @@ -389,11 +389,11 @@ somewhat from the patterns supported by Logstash. See <> for a l + [options="header"] |======================= -|Setting for `negate` | Setting for `match` | Result -|`false` | `after` | Consecutive lines that match the pattern are appended to the previous line that doesn't match. -|`false` | `before` | Consecutive lines that match the pattern are prepended to the next line that doesn't match. -|`true` | `after` | Consecutive lines that don't match the pattern are appended to the previous line that does match. -|`true` | `before` | Consecutive lines that don't match the pattern are prepended to the next line that does match. +|Setting for `negate` | Setting for `match` | Result | Example `pattern: ^b` +|`false` | `after` | Consecutive lines that match the pattern are appended to the previous line that doesn't match. | image:./images/false-after-multi.png[Lines a b b c b b become "abb" and "cbb"] +|`false` | `before` | Consecutive lines that match the pattern are prepended to the next line that doesn't match. | image:./images/false-before-multi.png[Lines b b a b b c become "bba" and "bbc"] +|`true` | `after` | Consecutive lines that don't match the pattern are appended to the previous line that does match. | image:./images/true-after-multi.png[Lines b a c b d e become "bac" and "bde"] +|`true` | `before` | Consecutive lines that don't match the pattern are prepended to the next line that does match. | image:./images/true-before-multi.png[Lines a c b d e b become "acb" and "deb"] |======================= + NOTE: The `after` setting is equivalent to `previous` in https://www.elastic.co/guide/en/logstash/current/plugins-codecs-multiline.html[Logstash], and `before` is equivalent to `next`.