I've just installed filebeats and I am trying to configure it to include_lines that contain square brackets. For example, the log file entry would be something like "Storage swapped on [DBName].[TableName1]".
I tried configuring the yml as follows, but this isn't working:
#include_lines: ["^ERR", "^WARN"]
include_lines: ["Storage swapped on [DBName].[TableName1]", "Error", "ERROR"]
If I remove the square brackets from the string it works, but this gives me messages for all tables:
include_lines: ["Storage swapped"]
So I am assuming it's the square brackets it doesn't like? Do I need to escape these characters, and if so how?!