{"action":"created","issue":{"url":"https://api.github.com/repos/elastic/beats/issues/2876","repository_url":"https://api.github.com/repos/elastic/beats","labels_url":"https://api.github.com/repos/elastic/beats/issues/2876/labels{/name}","comments_url":"https://api.github.com/repos/elastic/beats/issues/2876/comments","events_url":"https://api.github.com/repos/elastic/beats/issues/2876/events","html_url":"https://github.com/elastic/beats/issues/2876","id":185878899,"number":2876,"title":"Multiple lines forwarded","user":{"login":"tronicum","id":534773,"avatar_url":"https://avatars.githubusercontent.com/u/534773?v=3","gravatar_id":"","url":"https://api.github.com/users/tronicum","html_url":"https://github.com/tronicum","followers_url":"https://api.github.com/users/tronicum/followers","following_url":"https://api.github.com/users/tronicum/following{/other_user}","gists_url":"https://api.github.com/users/tronicum/gists{/gist_id}","starred_url":"https://api.github.com/users/tronicum/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tronicum/subscriptions","organizations_url":"https://api.github.com/users/tronicum/orgs","repos_url":"https://api.github.com/users/tronicum/repos","events_url":"https://api.github.com/users/tronicum/events{/privacy}","received_events_url":"https://api.github.com/users/tronicum/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-10-28T09:30:51Z","updated_at":"2016-10-28T09:33:21Z","closed_at":null,"body":"For confirmed bugs, please report:\r\n- Version: filebeat-5.0.0-1.x86_64 (rpm from https://artifacts.elastic.co/packages/5.x/yum)\r\n- Operating System: Red Hat Enterprise Linux Server release 6.8 (Santiago)\r\n- Steps to Reproduce: \r\na) add an path for logging (in our case, a gluu.org Identety provider tomcat logfile)\r\n - /opt/gluu-server/opt/apache-tomcat-7.0.55/logs/oxtrust.log\r\nits forwarded to logstash ( installed via docker from logstash:5 with filebeat input plugin [ Dockerfile with RUN JARS_DEBUG=true JARS_VERBOSE=true DEBUG=1 logstash-plugin install logstash-input-beats]\r\ncurrently:\r\n/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-beats-3.1.6-java/vendor/jar-dependencies/org/logstash/beats/logstash-input-beats/3.1.6/logstash-input-beats-3.1.6.jar)\r\n\r\nb) if I lookup within kibana i see :\r\n```\r\nmessage:\r\n    DEBUG [org.gluu.oxtrust.action.Authenticator] Configuring application after user 'scim' login TEST DaSS double....\r\n@version:\r\n    1\r\n@timestamp:\r\n    October 28th 2016, 11:20:32.537\r\nbeat.name:\r\n    our.host.name-192.168.x.y\r\nbeat.hostname:\r\n    <our.host.name>\r\nbeat.version:\r\n    5.0.0\r\nsource:\r\n    /opt/gluu-server/opt/apache-tomcat-7.0.55/logs/oxtrust.log\r\noffset:\r\n    3656405\r\ntype:\r\n    log\r\ninput_type:\r\n    log\r\nhost:\r\n     <our.host.name>\r\ntags:\r\n    beats_input_codec_plain_applied\r\n_id:\r\n    AVgKl08eMZwDm0heaclP\r\n_type:\r\n    log\r\n_index:\r\n    filebeat-2016.10.28\r\n_score:\r\n```\r\n\r\nAND\r\n\r\n```\r\nmessage:\r\n    DEBUG [org.gluu.oxtrust.action.Authenticator] Configuring application after user 'scim' login TEST DaSS double....\r\n@version:\r\n    1\r\n@timestamp:\r\n    October 28th 2016, 11:20:32.537\r\nbeat.name:\r\n    our.host.name-192.168.x.y\r\nbeat.hostname:\r\n     <our.host.name>\r\nbeat.version:\r\n    5.0.0\r\nsource:\r\n    /opt/gluu-server/opt/apache-tomcat-7.0.55/logs/oxtrust.log\r\noffset:\r\n    3656405\r\ntype:\r\n    log\r\ninput_type:\r\n    log\r\nhost:\r\n     <our.host.name>\r\ntags:\r\n    beats_input_codec_plain_applied\r\n_id:\r\n    AVgKl08ZMZwDm0heaclO\r\n_type:\r\n    log\r\n_index:\r\n    logstash-2016.10.28\r\n_score:\r\n```\r\n\r\nAfter I added dummy logging via\r\n`echo \"DEBUG [org.gluu.oxtrust.action.Authenticator] Configuring application after user 'scim' login TEST DaSS double....\" >> /opt/gluu-server/opt/apache-tomcat-7.0.55/logs/oxtrust.log`"},"comment":{"url":"https://api.github.com/repos/elastic/beats/issues/comments/256877802","html_url":"https://github.com/elastic/beats/issues/2876#issuecomment-256877802","issue_url":"https://api.github.com/repos/elastic/beats/issues/2876","id":256877802,"user":{"login":"tronicum","id":534773,"avatar_url":"https://avatars.githubusercontent.com/u/534773?v=3","gravatar_id":"","url":"https://api.github.com/users/tronicum","html_url":"https://github.com/tronicum","followers_url":"https://api.github.com/users/tronicum/followers","following_url":"https://api.github.com/users/tronicum/following{/other_user}","gists_url":"https://api.github.com/users/tronicum/gists{/gist_id}","starred_url":"https://api.github.com/users/tronicum/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tronicum/subscriptions","organizations_url":"https://api.github.com/users/tronicum/orgs","repos_url":"https://api.github.com/users/tronicum/repos","events_url":"https://api.github.com/users/tronicum/events{/privacy}","received_events_url":"https://api.github.com/users/tronicum/received_events","type":"User","site_admin":false},"created_at":"2016-10-28T09:33:21Z","updated_at":"2016-10-28T09:33:21Z","body":"as is see id: AVgKl08eMZwDm0heaclP and id: AVgKl08ZMZwDm0heaclO I guess somewhere that line gets duplicated. "}}
{"actor":{"display_login":"tronicum"}}