Combining multiline from Laravel Horizon app

Elastic Stack Beats
1

Hello,

I'm looking for a way to parse and combine a log of this format:

[2019-08-26 13:53:53][83304] Processing: App\Jobs\PublishListingUpdate
[2019-08-26 13:53:53][83303] Processing: App\Jobs\PublishListingUpdate
[2019-08-26 13:53:53][83305] Processing: App\Jobs\PublishListingUpdate
[2019-08-26 13:53:53][83306] Processing: App\Jobs\PublishListingUpdate
[2019-08-26 13:53:54][83307] Processing: App\Jobs\PublishListingUpdate
[2019-08-26 13:54:12][83304] Processed: App\Jobs\PublishListingUpdate
[2019-08-26 13:54:16][83306] Processed: App\Jobs\PublishListingUpdate
[2019-08-26 13:54:17][83303] Processed: App\Jobs\PublishListingUpdate
[2019-08-26 13:54:18][83305] Processed: App\Jobs\PublishListingUpdate
[2019-08-26 13:54:18][83307] Processed: App\Jobs\PublishListingUpdate
[2019-08-26 13:54:38][83308] Processing: App\Jobs\PublishListingUpdate
[2019-08-26 13:54:41][83308] Processed: App\Jobs\PublishListingUpdate
[2019-08-26 13:54:44][83309] Processing: App\Jobs\PublishListingUpdate
[2019-08-26 13:54:47][83309] Processed: App\Jobs\PublishListingUpdate

Each run started with DATE TIMESTAMP [uniq id] Processing: and can end a few rows below, the job ends with DATE TIMESTAMP [uniq id] Processed

Is it possible to have a ([0-9]) match group that binds them together?

2

Sorry, forgot to mention that I'm running filebeat v7.3.1 and would like to acheive this with
multiline.pattern/negate/match in filebeat.yml

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.