Matching a word with filebeat multiline

Elastic Stack Beats
1

I am using Filebeat multiline pattern in filebeat.yml that is taking its input from a single file that has the following line indicating the start of a request

2016-10-06 09:40:01.775 DEBUG 10454 --- [XNIO-2 task-9] c.a.a.s.abc.efgh.server: requestStartIdentifier: Identifier

filebeat.yml

multiline:
pattern: 'Identifier$'
negate: false
match: after

I use the above config to match 'Identifier ' in the line . can anyone please suggest me the pattern to select whole string in the line that ends with Identifier .

2

Can you post a longer portion of the log file and how you want it grouped together. It's not clear to me what the requirement is. Thanks.

3

Looks like a duplicate of http://stackoverflow.com/a/39899056/503798 which has a working answer.

4

This topic was automatically closed after 21 days. New replies are no longer allowed.