Filebeat Parsing for Multiline including previous lines from the log

[abinashkd (Abinash Kumar Dalai)]

Hi,

I am trying to parse a log which have the context as below:

[2019-06-20 08:51:10]
Build ID: XXXXX
Build time: XXXXX
Application version: XXXXX
Category: XXXXX
Message: Nested Exception
StackTrace:

java.sql.SQLSyntaxErrorException: ORA-00933: SQL command not properly ended

 XXXXXXXXXXXXXXXXXX

filebeat.yml file:

multiline.pattern: 'Build ID'
multiline.negate: true
multiline.match: after
multiline.max_lines: 10

How can I include the timestamp[2019-06-20 08:51:10] of the log in filebeat parsing i.e is there any way so that the previous line of pattern matching can be considered.

Thanks in advance.

[Mario_Castro]

Hi @abinashkd

I'm afraid that or you add before the pattern or after, but you cannot add before and after the match.

You should try to match the timestamp and use the after match