Multi Line Pattern

Hello everyone,

I am currently having a hard time trying to parse a customized log to logstash using filebeat. My servers are windows servers, using the latest version of filebeat 7.0.12.

the sample log

Received XML Message:

20210422 05:00:06:351 - [INFO] 'SECURITY / LOGIN' Received from '' on
20210422 05:00:06:429 - [INFO] TEXT...
20210422 05:00:06:445 - [INFO] TEXT...
20210422 05:00:06:445 - [INFO] TEXT...
20210422 05:00:06:445 - [INFO] TEXT...
20210422 05:00:06:445 - [INFO] TEXT...

Sent XML Message:

Example of what the log looks like formatted on server

I am using the below to try and grab the whole log, which is not currently working.

multiline.pattern: '(?im)^Received XML Message:'
multiline.negate: true
multiline.match: after
multiline.flush_pattern: '(?im)^Sent XML Message:\r?\n<XML.*'

Any idea how i can manage to parse the full message please?

If you have a question about filebeat you would be better off asking in the beats forum rather than the logstash forum.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.