Issue with Parsing multiline log in together with filebeat multiline config and logstash

[marco2005]

Okay. Let me try it again and see if I missed something or a typo. I will update you.
There was a typo in the pattern I passed the last time with the updated look ahead gsub. I re-checked it today morning and all seems to work fine.
Thanks a lot for your help.

[marco2005]

Following up on the same question. is there a way to replace the + with nothing in PAGER field. I tried this without success:

mutate {
       gsub => [ "PAGER", "\+", ""]
    }

and

   mutate {
               gsub => [ "PAGER", "[\+]", ""]
            }

[Badger]

I don't think you need to escape the + in those contexts.

[marco2005]

Ignore me it works