Kibana grok debug custom pattern failure

[zozo6015 (Peter)]

Hello I have a grok pattern with multiline pattern. On version 6.x everything worked but since I have migrated to 7.3.0 is not working anymore. I have tried to see if it is still matching in kibana but I always get an error messages:

Any suggestion what can I change to make it work again?

[Brandon_Kobel]

Hey @zozo6015, when using the Grok Debugger, you specify custom patterns like the following:

GREEDYMULTILINE (.|\r|\n)*

Also, instead of using \n in your Sample Data, you'll want to use a newline itself:

Sep 16, 2019 9:51:52 AM com.candorgrc.core.login.UsersSessionManager logoutSession
INFO: ======== UsersSessionManager.logoutSession: node0n8qucd2hkkosxo25r5ff1e67j263286

[zozo6015 (Peter)]

@Brandon_Kobel

Also, instead of using \n in your Sample Data, you'll want to use a newline itself:

Thank you, now I only need to figure out why the logstash does not want to handle the custom pattern.

[Brandon_Kobel]

If you post a new question over in the Logstash section, they should be able to help you out.