Help with multiline log from Windows 2016 Server to Kibana

Elastic Stack Beats
1

HI,

I am having trouble with getting the multiline logs to show up right in Kibana using filebeats 6.8.2.

I've tried using the following:

multiline.pattern: '^\d{1,2}\/\d{1,2}\/\d{4} \d{1,2}:\d{2}:\d{2} (AM|PM) :'
multiline.negate: false
multiline.match: after

and

multiline.pattern: '^[[:space:]]'
multiline.negate: false
multiline.match: after

Example log:

1/24/2019 9:31:22 AM : PutTripRequest status: Starting...
1/24/2019 9:31:22 AM : Trip booking request processed successfully
1/25/2019 11:15:27 AM : Communication Link Failure
   at Pervasive.Data.SqlClient.Lna.ae.a(Stream )
   at Pervasive.Data.SqlClient.Lna.am.a(v , u )
   at Pervasive.Data.SqlClient.Lna.am.ci(v )
   at Pervasive.Data.SqlClient.Lna.aw.e()
1/25/2019 11:17:21 AM : Communication Link Failure
   at Pervasive.Data.SqlClient.Lna.am.a(v , u )
   at Pervasive.Data.SqlClient.Lna.am.ci(v )
   at Pervasive.Data.SqlClient.Lna.aw.e()
   at Pervasive.Data.SqlClient.PsqlCommand.a(Boolean , CommandBehavior , Boolean )

The logs are still on different lines in Kibana (nothing changes)
Seems to work on golang

Please let me know what I am doing wrong.

2

I been trying to test on https://regex101.com/ and I am still stumped.
REGEXP pattern seems correct
Any reason nothing happens in Kibana and still creates multiple lines?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.