Filebeat-multiline not working

Hello ,

I have below logs to parse .No idea if timestamp in grok is the one which is failing or multiline conf in filebeat .please help

Timestamp: 8/19/2019 4:17:15 PM
Message: affd Response | 130313 | GetUsageDetails | 0.1206999 Seconds | Uri | https://bdsdsm-bsdfd-dds-1.pdddd.dcddd.idddt.bddd.ca/Edssfe/AdJSON/billfsfsfng/gdsdfs | ResponsePhrase | OK | Action | Awewddc/billing/getUsageDewee | Code | 0000000000 | RequestId | 130313
Timestamp: 8/19/2019 4:17:16 PM
Message: AMdddf Response | 130316 | GetNagDetails | 0.1039091 Seconds | Uri | https://bwfeffm-bfdfd-tls-1.prod.dfgf.int.wwdwf.ca/ECafdfefe/Adsfff/accountInfo/getNagDetails | ResponsePhrase | OK | Action | dsdsf/accountInfo/getNagDetails | Code | 0000000000 | RequestId | 130316
Timestamp: 8/19/2019 4:17:16 PM

Grok

input {
beats {
port => 5044
}
}

filter {

grok {
patterns_dir => ["C:\Users\manu.manu\Desktop\ELK\Patterns"]
match => { "message" => "%{Time:tym} \n %{MSG:Message}\s*| %{N:RequestedID} %{GREEDYDATA} %{WORD:GetMethod} | %{N:ResponseTime} %{GREEDYDATA} %{URI:URIRequested} %{GREEDYDATA} %{WORD:Responsephrase} %{GREEDYDATA} %{ACC:Action} %{GREEDYDATA}" }
}
}

output {
elasticsearch {
hosts => ["http://localhost:9200"]
index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
#user => "elastic"
#password => "changeme"

}
}

Filebeat multiline config ---------------------------------------------------

The regexp Pattern that has to be matched. The example pattern matches all lines starting with [

multiline.pattern: '^T'

Defines if the pattern set under pattern should be negated or not. Default is false.

multiline.negate: true

Match can be set to "after" or "before". It is used to define if lines should be append to a pattern

that was (not) matched before or after or as long as a pattern is not matched based on negate.

Note: After is the equivalent to previous and before is the equivalent to to next in Logstash

multiline.match: before

Please check https://www.elastic.co/guide/en/beats/filebeat/current/_examples_of_multiline_configuration.html

Also, verify your multiline pattern on https://play.golang.org

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.