Grok debugger parse problem

Good day, I have some problem when I am trying to debug Grok pattern via Kibana

For some reasons, it is not matching, but should. Fe from http://grokdebug.herokuapp.com/
I can parse it without problems:


Can you please check it, looks like patterns with "/n" with multiline log not possible to parse them with kibana debugger.

Sample data:

[2021-04-14 13:29:46,517] [DEBUG] [http-192.168.239.131-8280-4] [com.valuephone.management.extension.ws.SoapLoggingHandler]
-------------------------
ID: 123123 - OUTBOUND message
Request processing time: 23ms
HTTP response header names: X-Powered-By
* X-Powered-By: Servlet/3.0; JBossAS-6
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">soap:Body<ns2:logoutResponse xmlns:ns2="http://customer.example.com"/></soap:Body></soap:Envelope>
-------------------------

Grok:

%{DATESTAMP:date}] [%{WORD:level}%{SPACE}] [%{DATA:threadId}] [%{JAVACLASS:className}] []%{SPACE} \n-------------------------\n((?:ID|\G): %{NUMBER:message_id}) - %{WORD:type_msg} message\n((?:Request processing time|\G): %{NUMBER:processing_time_milliseconds:I}ms)\nHTTP response header names: X-Powered-By\n%{GREEDYDATA}

Kibana v7.9.3

Hello,
Can you open an issue with your findings in the Kibana repo on Github?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.