Multi line pattern in filebeat

Elastic Stack Beats
1

Dears
what will be the multiline pattern for below message in the file beat config , i tried all the way but its not getting correct output from filebeat to logstash

tried with space filter but its not sending closing tag to log stash

    2020-09-30/11:44:40.690/AST TRACE <?xml version="1.0" encoding="UTF-8"?><nam:Notify xmlns:nam="NAM-v1.4">
         <MessageIdentifier>16014554875</MessageIdentifier>
         <MessageTimeStamp>2020-09-30T11:44:40.675+03:00</MessageTimeStamp>
         <TypeOfTransaction>Update</TypeOfTransaction>
         <TravellerReference>24103085</TravellerReference>
    </nam:Notify>
2

Hello Billy,

The message always starts with a date and time, right? Then this is similar to other posts in this forum: Filebeat multiline regexp patterns help

Best regards
Wolfram

3

Thank you its works now

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.