Include_lines not match with "^\\{"

Elastic Stack Beats
1

hi:

I have jsonp log file have below format, I want to filter it with include_lines:["^\\{"] rule, but it cannot filter start with "{" line's log

 {"level":"info","ts":1583809821.8151295,"caller":"v3@v3.1.0/default.go:34","msg":"test log","svcName":"XXX"}

Filebeat version

7.6.1

Filebeat config

logging.level: info
filebeat.inputs:


- type: log
  
  enabled: true

  paths:
    - /home/benjamin/work/filebeat_test/test_log.log


  include_lines: ["^\\{"]

  tail_files: false
  json.keys_under_root: false
  json.overwrite_keys: false
  json.add_error_key: true
  json.message_key: msg
  json.ignore_decoding_error: true
  fields_under_root: true
  close_removed: true
  clean_removed: true 
  #ignore_older: 12m
  close_inactive: 10m

output.file:
  path: "/tmp/filebeat"
  filename: filebeat

test_log.log

{"level":"info","ts":1583809813.812187,"caller":"v3@v3.1.0/default.go:34","msg":"test log","svcName":"XXX"}
{"level":"info","ts":1583809814.8124492,"caller":"v3@v3.1.0/default.go:34","msg":"test log","svcName":"XXX"}
{"level":"info","ts":1583809815.81283,"caller":"v3@v3.1.0/default.go:34","msg":"test log","svcName":"XXX"}
{"level":"info","ts":1583809816.813194,"caller":"v3@v3.1.0/default.go:34","msg":"test log","svcName":"XXX"}
{"level":"info","ts":1583809817.8135798,"caller":"v3@v3.1.0/default.go:34","msg":"test log","svcName":"XXX"}
{"level":"info","ts":1583809818.8139517,"caller":"v3@v3.1.0/default.go:34","msg":"test log","svcName":"XXX"}
{"level":"info","ts":1583809819.8142812,"caller":"v3@v3.1.0/default.go:34","msg":"test log","svcName":"XXX"}
{"level":"info","ts":1583809820.814623,"caller":"v3@v3.1.0/default.go:34","msg":"test log","svcName":"XXX"}
{"level":"info","ts":1583809821.8151295,"caller":"v3@v3.1.0/default.go:34","msg":"test log","svcName":"XXX"}
{"level":"info","ts":1583809822.8154478,"caller":"v3@v3.1.0/default.go:34","msg":"test log","svcName":"XXX"}
{"level":"info","ts":1583809823.81576,"caller":"v3@v3.1.0/default.go:34","msg":"test log","svcName":"XXX"}
{"level":"info","ts":1583809824.816089,"caller":"v3@v3.1.0/default.go:34","msg":"test log","svcName":"XXX"}
{"level":"info","ts":1583809825.8164127,"caller":"v3@v3.1.0/default.go:34","msg":"test log","svcName":"XXX"}
{"level":"info","ts":1583809826.816784,"caller":"v3@v3.1.0/default.go:34","msg":"test log","svcName":"XXX"}
{"level":"info","ts":1583809827.817367,"caller":"v3@v3.1.0/default.go:34","msg":"test log","svcName":"XXX"}
{"level":"info","ts":1583809828.8177087,"caller":"v3@v3.1.0/default.go:34","msg":"test log","svcName":"XXX"}
{"level":"info","ts":1583809829.8181396,"caller":"v3@v3.1.0/default.go:34","msg":"test log","svcName":"XXX"}
{"level":"info","ts":1583809830.8186045,"caller":"v3@v3.1.0/default.go:34","msg":"test log","svcName":"XXX"}
{"level":"info","ts":1583809831.8188229,"caller":"v3@v3.1.0/default.go:34","msg":"test log","svcName":"XXX"}
{"level":"info","ts":1583809832.8191283,"caller":"v3@v3.1.0/default.go:34","msg":"test log","svcName":"XXX"}
{"level":"info","ts":1583809833.8194058,"caller":"v3@v3.1.0/default.go:34","msg":"test log","svcName":"XXX"}
{"level":"info","ts":1583809834.8196137,"caller":"v3@v3.1.0/default.go:34","msg":"test log","svcName":"XXX"}
{"level":"info","ts":1583809835.8198535,"caller":"v3@v3.1.0/default.go:34","msg":"test log","svcName":"XXX"}
{"level":"info","ts":1583809836.8201323,"caller":"v3@v3.1.0/default.go:34","msg":"test log","svcName":"XXX"}
{"level":"info","ts":1583809837.8203838,"caller":"v3@v3.1.0/default.go:34","msg":"test log","svcName":"XXX"}
{"level":"info","ts":1583809838.8207636,"caller":"v3@v3.1.0/default.go:34","msg":"test log","svcName":"XXX"}
{"level":"info","ts":1583809839.8212154,"caller":"v3@v3.1.0/default.go:34","msg":"test log","svcName":"XXX"}
{"level":"info","ts":1583809840.8215845,"caller":"v3@v3.1.0/default.go:34","msg":"test log","svcName":"XXX"}
{"level":"info","ts":1583809841.8219452,"caller":"v3@v3.1.0/default.go:34","msg":"test log","svcName":"XXX"}
{"level":"info","ts":1583809842.8223512,"caller":"v3@v3.1.0/default.go:34","msg":"test log","svcName":"XXX"}
{"level":"info","ts":1583809843.822588,"caller":"v3@v3.1.0/default.go:34","msg":"test log","svcName":"XXX"}
{"level":"info","ts":1583809844.8228757,"caller":"v3@v3.1.0/default.go:34","msg":"test log","svcName":"XXX"}
{"level":"info","ts":1583809845.8233416,"caller":"v3@v3.1.0/default.go:34","msg":"test log","svcName":"XXX"}
{"level":"info","ts":1583809846.8236098,"caller":"v3@v3.1.0/default.go:34","msg":"test log","svcName":"XXX"}
{"level":"info","ts":1583809847.8238847,"caller":"v3@v3.1.0/default.go:34","msg":"test log","svcName":"XXX"}
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.