Filebeat multiline - entire log file published as 1 long event

[Roy]

Hi All,

I'm having an issue with filebeat multiline events.
All log file is being published as 1 long message.

My log lines looks like:
"GS category US severity..."

The GS is group seperator in unicode, and filebeat reads ir as "\u001d" and logstash receives it as "\u001D"

Config:

pattern: '^\u001|\u001D'
negate: true
match: after

If i'm changing the log to start lines with different seperator, for example "--".

And configuration:
pattern:'^--'
negate: true
match: after

Works perfect..

Can it be a filebeat bug that it can't recognize the GS seperator correctly, or maybe my pattern is incorrect?

Thanks,
Roy.

[steffens (Steffen Siering)]

hm.... I'm not sure \u will be correctly interpreted as unicode by the regex parser. Btw, is this correct: '^\u001|\u001D’ ? Shouldn't it say ^\u001d. As \u meens, interpret these number as unicode, there shouldn't be a difference between \u001d and \u001D. It's the json encoder sending \u001D I guess.