I am trying to configure Filebeats to only process lines from my logs which match a couple of regexes. Nothing too complicated.
I set it up like this:
But then I cannot start the Filebeat service.
It does however work with:-
include_lines: [".*returned the status.*",".*information from the green Server.*"]
However, for some strange reason lots and lots of other lines are also being caught and sent into ES.
My questions are:-
- Why is filebeats borking at the \s in the regex??
- What regex implementation does Filebeats actually use?
Bit more testing. I simplified the include_lines to be a single expression:-
include_lines: ["returned the status"]
But I am getting all manner of lines sent into ES. Not just the lines one might expect.
This is on a Windows machine. Can anyone shed any light on why "inlclude_line" is just doing its own thing?