Filebeat multiline - entire log file published as 1 long event

Hi All,

I'm having an issue with filebeat multiline events.
All log file is being published as 1 long message.

My log lines looks like:
"GS category US severity..."

The GS is group seperator in unicode, and filebeat reads ir as "\u001d" and logstash receives it as "\u001D"


pattern: '^\u001|\u001D'
negate: true
match: after

If i'm changing the log to start lines with different seperator, for example "--".

And configuration:
negate: true
match: after

Works perfect..

Can it be a filebeat bug that it can't recognize the GS seperator correctly, or maybe my pattern is incorrect?


hm.... I'm not sure \u will be correctly interpreted as unicode by the regex parser. Btw, is this correct: '^\u001|\u001D’ ? Shouldn't it say ^\u001d. As \u meens, interpret these number as unicode, there shouldn't be a difference between \u001d and \u001D. It's the json encoder sending \u001D I guess.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.