Filebeat Multiline Config Help

Log start: Aug 24 03:32:21

Filebeat Multiline: multiline.pattern:

^[[A-Z][a-z]{3} [0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}

Logstash date filter:

"MMM dd HH:mm:ss"

For some reason, my Filebeat multiline pattern does not work for this log data. Is there something wrong with having spaces in the multiline pattern?

Hmm looking at example here, for timestamp the multiline pattern should be:

'^\[[A-Z][a-z]{3} [0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}'

Maybe you are only missing \?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.