I am trying to parse an xml file as shown below
i tried to use the multiline filter of logstash as
multiline {
pattern => ".*</LogMessage>"
negate => true
what => "previous"
}
It is not giving me correct parsing but if i use
multiline {
pattern => ".*</LogMessage>"
negate => true
what => "next"
}
it parses perfectly , Now according to my understanding if the pattern matches then it need to be configured to be included to "previous" but specifying "next" works, i am misunderstanding something here ?
Thanks,
sam