Team,
I have multiline message that is a json, I have tried parsing it using the multi line filter, though the below filter parses it all correctly except for the closing '}'. Any ideas on what I'm doing wrong. I know one alternative is to mutate the message at logstash and add the missing brace, but I wanted to check if filebeat can by itself send the message correctly.
Sample log message
Sat Nov 23 08:34:30.238 2019 INFO: pid 15 tid 140527294039808: 4202 201911230833054:CacheManager::verifyRequest: DB logging is done (201911230833054)
Sat Nov 23 08:34:30.238 2019 LOW: pid 15 tid 140527294039808: 4510 201911230833054:verifyRequest: Json message 'abc': {
"id" : "id1",
"name" : "name1",
"Type" : "type1",
"version" : "2.1.0",
"status" : "01",
"Tid" : "f1c84c86-a6df-c7141fcbb112"
} (201911230833054)
Sat Nov 23 08:34:30.238 2019 INFO: pid 15 tid 140527294039808: 4209 201911230833054:handle_req: end (201911230833054)
The filebeat config looks like the following
multiline.pattern: '^[[:space:]]'
multiline.negate: false
multiline.match: after
mutliline.flush_pattern: '^}'