type: log
paths:
{{ range $i, $path := .paths }}
 - {{$path}}
{{ end }}
exclude_files: ['.gz$']
multiline:
  pattern: '^(# User@Host: |# Time: )'
  negate: true
  match: after
exclude_lines: ['^[\/\w\.]+, Version: .* started with:.*', '^# Time:.*']   # Exclude the header and time
processors:
  - add_fields:
      target: ''
      fields:
        ecs.version: 1.5.0
