Filebeat Parsing for Multiline including previous lines from the log


I am trying to parse a log which have the context as below:

[2019-06-20 08:51:10]
Build time: XXXXX
Application version: XXXXX
Category: XXXXX
Message: Nested Exception

java.sql.SQLSyntaxErrorException: ORA-00933: SQL command not properly ended


filebeat.yml file:

multiline.pattern: 'Build ID'
multiline.negate: true
multiline.match: after
multiline.max_lines: 10

How can I include the timestamp[2019-06-20 08:51:10] of the log in filebeat parsing i.e is there any way so that the previous line of pattern matching can be considered.

Thanks in advance.

Hi @abinashkd :slightly_smiling_face:

I'm afraid that or you add before the pattern or after, but you cannot add before and after the match.

You should try to match the timestamp and use the after match

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.