Grok pattern test well in GrokDebugger,but got nothing in logstash after process input file with multiline.
Input looks like this:
[2016-08-30 15:09:30,906][/data/release/cdn/cgi/apps/cdn/RequestAjax.class.php:176:__destruct][25727][2:1] \n============= response ============\nHTTP: 165 ms, action=get_diagnose_list\nrequest = {\"action\":\"get_diagnose_list\",\"_format\":\"jsonp\",\"g_tk\":\"1232608870\",\"cb\":\"jQuery110205107408485770859_1472540967831\",\"_\":\"1472540967833\"}\nresponse = {\"code\":0,\"data\":{\"total\":1,\"list\":[{\"task_id\":141,\"url\":\"http:\\/\\/addhosttest2.oa.com\",\"report_id\":\"7abfef7c\",\"ip\":\"182.131.19.97\",\"create_time\":\"2016-08-15 14:57:38\",\"status\":3,\"sub_diagnose\":0,\"final_diagnose\":1,\"prov_name\":\"\\u56db\\u5ddd\\u7701\"}]}}\ninfo = {\"appId\":1251007194,\"uin\":909619400,\"costTime\":165}
Grok pattern :
\[%{TIMESTAMP_ISO8601:timestamp}\]\[%{DATA:file_name}\]\[%{DATA:thread_num}\]\[%{DATA:line}\](?<char_1>(\s|\r|\n|.)*HTTP:(\s)*)(?<timecost>\d{1,5})\ ms,\ action=%{DATA:action}\\nrequest\ \ =\ (?<request>.*)\\nresponse\ =\ (?<response>.*)\\ninfo\ =\ (?<info>(.|\n)*)