Filebeat multiline pattern

[Bhavin_Varsur]

In the picture stacktrace of log message taking the new log line
I want them in one log.
How to do that ?

Here is my log example :

2020-10-01 16:39:18.4120 ERROR LeadsController bhavin http://bhavin/Leads/New POST 192.168.43.244 Provide a valid PhoneNumber.GurukulERP.Logic.InvalidDataException: Provide a valid PhoneNumber.
at GurukulERP.API.Controllers.CRM.LeadsController.New(AdmissionLead model) in D:\Git\gbase.API\API\Controllers\CRM\LeadsController.cs:line 474

here is my multiline pattern:
multiline.pattern: '^[1]'
multiline.negate: false
multiline.match: after

---

1. [:space:] ↩︎

[Wolfram_Haussig]

Hi,

I guess the problem is that the first line of the stacktrace does not start with a space - it starts with a dash sign. There are multiple threads within this forum for multiline support (e.g. Filebeat multiline regexp patterns help). Please have a look there. In short:

• change the pattern to match your date-time at the start of the main line
• switch negate to true

Best regards
Wolfram

[Bhavin_Varsur]

Hi Wolfram,

I tried and its showing in right way
Thank you !