Kibana grok debug custom pattern failure

Elastic Stack Kibana
1

Hello I have a grok pattern with multiline pattern. On version 6.x everything worked but since I have migrated to 7.3.0 is not working anymore. I have tried to see if it is still matching in kibana but I always get an error messages:

10

Any suggestion what can I change to make it work again?

2

Hey @zozo6015, when using the Grok Debugger, you specify custom patterns like the following:

GREEDYMULTILINE (.|\r|\n)*

35%20AM
Screen Shot 2019-09-16 at 11.36.35 AM.png3150×616 36 KB

Also, instead of using \n in your Sample Data, you'll want to use a newline itself:

Sep 16, 2019 9:51:52 AM com.candorgrc.core.login.UsersSessionManager logoutSession
INFO: ======== UsersSessionManager.logoutSession: node0n8qucd2hkkosxo25r5ff1e67j263286

54%20AM
Screen Shot 2019-09-16 at 11.39.54 AM.png3272×1740 374 KB

3

Thank you, now I only need to figure out why the logstash does not want to handle the custom pattern.

4

If you post a new question over in the Logstash section, they should be able to help you out.