Hello I have a grok pattern with multiline pattern. On version 6.x everything worked but since I have migrated to 7.3.0 is not working anymore. I have tried to see if it is still matching in kibana but I always get an error messages:
Any suggestion what can I change to make it work again?
Hey @zozo6015, when using the Grok Debugger, you specify custom patterns like the following:
Also, instead of using
\n in your Sample Data, you'll want to use a newline itself:
Sep 16, 2019 9:51:52 AM com.candorgrc.core.login.UsersSessionManager logoutSession
INFO: ======== UsersSessionManager.logoutSession: node0n8qucd2hkkosxo25r5ff1e67j263286
Thank you, now I only need to figure out why the logstash does not want to handle the custom pattern.
If you post a new question over in the Logstash section, they should be able to help you out.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.