Filebeat Multiline Config Help

Elastic Stack Beats
1

Log start: Aug 24 03:32:21

Filebeat Multiline: multiline.pattern:

^[[A-Z][a-z]{3} [0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}

Logstash date filter:

"MMM dd HH:mm:ss"

For some reason, my Filebeat multiline pattern does not work for this log data. Is there something wrong with having spaces in the multiline pattern?

2

Hmm looking at example here, for timestamp the multiline pattern should be:

'^\[[A-Z][a-z]{3} [0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}'

Maybe you are only missing \?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.