Hello. I am streaming mdaemon logs using filebeat and using multiline.pattern to concatenate lines into one event. Using logstash, I create fields "mail from", "mail to", "message id", etc. Is it possible to make grok understand the end of the line "\ n"? Json sample from kibana: "Tue 2021-09-1…

Thanks for the tip! As a result, I use the following configuration: my custom grok NEXT_LINE [^\\\n]* logstash config file if "mdaemon_smtp" in [tags] { grok { patterns_dir => ["/etc/logstash/patterns"] break_on_match => false match => { "message" => [ "From: %{NEXT_LINE:mail_from}", "…

Discuss the Elastic Stack

Logstash misinterprets incoming data

Elastic Stack Logstash

Badger September 27, 2021, 2:07pm 2

You can anchor each pattern, or match everything up to a newline.

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.