Issue with Parsing multiline log in together with filebeat multiline config and logstash

Elastic Stack Logstash
21

Okay. Let me try it again and see if I missed something or a typo. I will update you.
There was a typo in the pattern I passed the last time with the updated look ahead gsub. I re-checked it today morning and all seems to work fine.
Thanks a lot for your help.

22

Following up on the same question. is there a way to replace the + with nothing in PAGER field. I tried this without success:

mutate {
       gsub => [ "PAGER", "\+", ""]
    }

and

   mutate {
               gsub => [ "PAGER", "[\+]", ""]
            }
23

I don't think you need to escape the + in those contexts.

24

Ignore me it works

25

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.