title: Fluentd tail source not moving logs to ElasticSearch
body: <p>I'm trying to move my Python logs files into ElastiSearch using a Fluentd tail source:</p>
  
  <pre><code>&lt;source&gt;
    @type  forward
    @id    input1
    @label @mainstream
    port  24224
  &lt;/source&gt;
  
  &lt;filter **&gt;
    @type stdout
  &lt;/filter&gt;
  
  &lt;source&gt;
    @type tail
    path /fluentd/formshare/error_log
    pos_file /fluentd/error_log.pos
    tag formshare.error
    &lt;parse&gt;
      @type multiline
      format_firstline /\d{4}-\d{1,2}-\d{1,2}/
      format1 /(?&lt;timestamp&gt;[^ ]* [^ ]*) (?&lt;level&gt;[^\s]+:)(?&lt;message&gt;[\s\S]*)/
    &lt;/parse&gt;
  &lt;/source&gt;
  
  &lt;label @mainstream&gt;
    &lt;match formshare.access.**&gt;
      @type elasticsearch
      host 172.28.1.1
      port 9200
      logstash_format true
      logstash_prefix formshare_access
    &lt;/match&gt;
    &lt;match formshare.error.**&gt;
      @type elasticsearch
      host 172.28.1.1
      port 9200
      logstash_format true
      logstash_prefix formshare_error
    &lt;/match&gt;
    &lt;match **&gt;
      @type file
      @id   output1
      path         /fluentd/log/data.*.log
      symlink_path /fluentd/log/data.log
      append       true
      time_slice_format %Y%m%d
      time_slice_wait   10m
      time_format       %Y%m%dT%H%M%S%z
    &lt;/match&gt;
  &lt;/label&gt;
  </code></pre>
  
  <p>I can see from starting the FluentD service that is parsing the file:</p>
  
  <blockquote>
    <p>following tail of /fluentd/formshare/error_log</p>
  </blockquote>
  
  <p>and the pos_file has data</p>
  
  <pre><code>/fluentd/formshare/error_log    0000000000000604        000000000098252c
  </code></pre>
  
  <p>But I don't get the errors in ElasticSearch. It might be parse but I am not good with Regex (got it from <a href="https://www.datadoghq.com/blog/multiline-logging-guide/" rel="nofollow noreferrer">https://www.datadoghq.com/blog/multiline-logging-guide/</a>)</p>
  
  <p>The connection to Elastic is working. The match formshare.access.** which I use with "fluent-logger-python"  works fine. Is just the tail source that does not seem to be working.</p>
  
  <p>I am super new to Fluentd so I don't know if I am doing things in the correct way or if I need something else in the configuration file.</p>
  
  <p>Any help is appreciated.</p>