Filebeat multiline pattern with linefeed

[thps (Torsten Lorenz)]

Dear all,

i try to match a multiline java - event in Filebeat via multiline pattern. In general, this is still working, but i´m not able to parse empty lines in this event. The String looks like this:

BMC:SR:2019-08-01 07:37:00:ERROR (TaskScheduler:run) - Error checking system schedules: 
com.hof.util.ActionErrorsException: DBAction constructor exception
com.hof.util.ActionErrorsException: DBAction constructor exception
    at com.hof.util.DBAction.<init>(DBAction.java:378)
    at com.hof.util.DBAction.<init>(DBAction.java:465)
    at com.hof.util.DBAction.<init>(DBAction.java:420)
    at com.hof.mi.servlet.TaskScheduler.A(TaskScheduler.java:335)
    at com.hof.mi.servlet.TaskScheduler.run(TaskScheduler.java:487)
    at java.util.TimerThread.mainLoop(Unknown Source)
    at java.util.TimerThread.run(Unknown Source)
Caused by: 

    at oracle.jdbc.driver.T4CTTIoer.processError(T4CTTIoer.java:445)
    at oracle.jdbc.driver.T4CTTIoer.processError(T4CTTIoer.java:389)
    at oracle.jdbc.driver.T4CTTIoer.processError(T4CTTIoer.java:382)
    at oracle.jdbc.driver.T4CTTIfun.processError(T4CTTIfun.java:600)
    at oracle.jdbc.driver.T4CTTIoauthenticate.processError(T4CTTIoauthenticate.java:445)
    at oracle.jdbc.driver.T4CTTIfun.receive(T4CTTIfun.java:450)
    at oracle.jdbc.driver.T4CTTIfun.doRPC(T4CTTIfun.java:192)
    at oracle.jdbc.driver.T4CTTIoauthenticate.doOAUTH(T4CTTIoauthenticate.java:380)
    at oracle.jdbc.driver.T4CTTIoauthenticate.doOAUTH(T4CTTIoauthenticate.java:760)
    at oracle.jdbc.driver.T4CConnection.logon(T4CConnection.java:401)
    at oracle.jdbc.driver.PhysicalConnection.<init>(PhysicalConnection.java:546)
    at oracle.jdbc.driver.T4CConnection.<init>(T4CConnection.java:236)
    at oracle.jdbc.driver.T4CDriverExtension.getConnection(T4CDriverExtension.java:32)
    at oracle.jdbc.driver.OracleDriver.connect(OracleDriver.java:521)
    at com.hof.pool.JDBCConnection.openConnection(JDBCConnection.java:179)
    at com.hof.pool.DBConnection.authenticateAndOpenConnection(DBConnection.java:127)
    at com.hof.pool.DBConnectionPool.A(DBConnectionPool.java:1211)
    at com.hof.pool.DBConnectionPool.checkOutConnection(DBConnectionPool.java:1347)
    at com.hof.pool.DBConnectionManager.getConnection(DBConnectionManager.java:309)
    at com.hof.util.DBAction.<init>(DBAction.java:352)
    ... 6 more

and my RegEx is:
'^[[:space:]]|^Caused by:|^java|^org|^com'

i also tried
'^[[:space:]]|^Caused by:|^java|^org|^com|^$'

but this doent work at all.

The shown character in this logevent (:set list in vi) ist "$".

Are there any ideas how to fix this?

Thanks a lot

[justkind]

Hmm, can you share your filebeat.yml configuration? Specifically the multiline parts.
According to the Go playground, your regex should work fine, with the '^$' capturing the empty line:

https://play.golang.org/p/OeC1cMuQNQe