How can set multiline in filebeat

Elastic Stack Beats
1

This is my log sample that all lines are starting with follow :
134.255.248.30 - - [01/May/2024:13:54:53 +0330]
I want to use multiline pattern in my filebeat.yml file so I used follow syntax

parsers:

  • multiline:
    type: pattern
    pattern: ^([\d.]{3,17} - - [[\d/:]{1,4}[A-Z]{1,3}[a-z/]{1,5}[\d:]{1,20})
    negate: true
    match: after
2

Is that correct ?

3

Would you please help me about multiline ?

4

Can anyone help me about multiline . Is that correct ?

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.