Filebeat include_lines to match multiple regexes in the same multilines?


I am trying to use filebeat to read multiple log files, from different applications but I want it to include only lines that have three matches in the lines.
For example, lines that have both
'\ssession_timing\s' and '"from_house":\s"*123', and
'\ssession_timing\s' and '"to_house":\s"*456'.
please how to I format my include_lines configuration to filter these correctly?

My first guess is this configuration:

  include_lines: ['\session_timing\s.*""from_house":\s"\*123', '\ssession_timing\s.*""to_house"\s"*456']

Could you please share a few example logs you want to be matched by these regexes? It would make it easier to come up with proper regexes. :slight_smile:

Your configuration makes a lot of sense.
I should have mentioned in the question that session timing comes after from/to _house.

Thanks again!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.