ELk收集java多行日志

filebeat配置文件内容：

filebeat.inputs:
- type: log
  enabled: true 
  paths:
    - /var/log/elasticsearch/linux58.log
  tags: ["java"]
  multiline.pattern: '^\['
  multiline.negate: true
  multiline.match: after

output.elasticsearch:
  hosts: ["10.0.0.51:9200"]
  indices:
    - index: "es_access-%{[beat.version]}-%{+yyyy.MM}"
      when.contains:
        tags: "java"

setup.template.name: "es"
setup.template.pattern: "es_*"
setup.template.enabled: false
setup.template.overwrite: true