Hi I have following lines, and I am using filebeat to publish this data to logstash and then trying to extract values using grok in Logstash filter, untell now every thing is good (new pattern, multiline config , etc...) the problem is the filebeat record my 2 lines bouth in one single line. i trye…

The issue here appears to be a bad pattern. The correct pattern for this use case is multiline.pattern: '^\[[0-9]{1,2}/[0-9]{2}/[0-9]{2}'. Notice how the month is either 1 or 2 digits (not exactly one as in the given example) and that the pattern is anchored to the start of the line with ^.

Discuss the Elastic Stack

Filebeat has problem to record new lines separated

Elastic Stack Beats

bab (Broou) November 1, 2018, 6:34pm 3

@Andrew_Cholakian1 yes you are right. Thank you, it work now.
That was pattern error.

Topic		Replies	Views
Filebeat multi line pattern not working Beats filebeat	6	87	May 20, 2025
SOLVED - Multi Line Help Beats filebeat	2	405	May 14, 2019
Filebeat Multiline Patterns not working for us Beats	11	5976	November 28, 2018
Filebeat-Multiline Beats filebeat	5	561	September 28, 2018
Filebeat not indetifying multiple line logs Beats filebeat	2	975	October 15, 2018

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Filebeat has problem to record new lines separated

Related topics