Issue with Parsing multiline log in together with filebeat multiline config and logstash

Okay. Let me try it again and see if I missed something or a typo. I will update you.
There was a typo in the pattern I passed the last time with the updated look ahead gsub. I re-checked it today morning and all seems to work fine.
Thanks a lot for your help.

Following up on the same question. is there a way to replace the + with nothing in PAGER field. I tried this without success:

mutate {
       gsub => [ "PAGER", "\+", ""]


   mutate {
               gsub => [ "PAGER", "[\+]", ""]

I don't think you need to escape the + in those contexts.

Ignore me it works

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.