type: log
paths:
{{ range $i, $path := .paths }}
- {{$path}}
{{ end }}
exclude_files: ['.gz$']
multiline:
pattern: '^(# User@Host: |# Time: )'
negate: true
match: after
exclude_lines: ['^[\/\w\.]+, Version: .* started with:.*', '^# Time:.*'] # Exclude the header and time
processors:
- add_fields:
target: ''
fields:
ecs.version: 1.12.0