Generally, you will have a tough time with multiline or pretty-printed JSON in LS, this is because it is hard to know when the last }
is reached especially if there is no newline after the }
character.
When you use the pattern => "^}$"
(a brace at the start of a line ) with what => "previous"
the text satisfying the pattern is not seen as belonging to the previous and the accumulation of JSON lines has no final }
.
Having said that a pattern => "^{$"
with what next relies on a timeout flush feature to flush the accumulation buffer because another \n{
is never seen. Filebeat's implementation of this timeout is better than the LS one.