Hi, I am attempting to parse log data that are on different lines. When its read through filebeat and sent to logstash, the message contains \n. Unfortunetly, I am unable to deal with this and am getting an error when I parse it like this: [59%20PM]

Do you have config.support_escapes enabled? Anyways, I think the problem was the trailing space at the end of the first line of your pattern.

Discuss the Elastic Stack

Logstash Grok New Line Syntax

Elastic Stack Logstash

Badger July 25, 2019, 12:37pm 2

Use a literal newline in the configuration to match a multiline pattern, like this.

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.