Logstash 6.8.10 Filebeat 6.8.9 Filebeat config: filebeat.inputs: - type: log enabled: true paths: - '/path/to/file' tags: - 'app' fields: app_id: some_app multiline.pattern: '^\[[0-9]{4}\-[0-9]{2}-[0-9]{2}' multiline.negate: true multiline.match: after logging.level: info …

Change GREEDYDATA to DATA and you will get "@metadata" => { "logtime" => "2020-10-28 15:27:24,646", "messageBody" => "Exception while doing something" },

sjne October 29, 2020, 12:35pm 6

If anyone could point out if there is a default in Logstash where dot matches newlines, I'd be really thankful!

Topic		Replies	Views
GREEDYDATA and newlines Logstash	7	8886	July 6, 2017
Multiline and Ingest Node Elasticsearch	7	4508	July 5, 2017
Grok not breaking on matching first pattern Logstash	1	368	October 15, 2018
Multiline grok problem Logstash	3	2680	July 6, 2017
Logstash grok match pattern for message field Logstash	34	18010	July 6, 2017

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Grok pattern to match Filebeat multiline input up to the first new line character

Related topics