I am using Multiline codec input plugin but the events which are not matching with my PATTERN it also processing those Events

Below is the codec which am using for multiline events.

codec => multiline {
	  pattern => "%{TIMESTAMP_ISO8601:syslogtime}\s%{WORD:str}\s%{WORD:s}\s%{YEAR:yeaa}-%{MONTHNUM:ooo}-%{MONTHDAY:ppp}\s%{TIME:trrrs}"
	  #pattern => "((^%{TIMESTAMP_ISO8601} %{WORD} %{WORD} %{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{TIME}))"
	  negate => true
      what => "previous"

How does the message/event look like?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.