Multi Line Pattern

I am currently having a hard time trying to parse a customized log to logstash using filebeat. My servers are windows servers, using the latest version of filebeat 7.0.12.

the sample log

Received XML Message:


20210422 05:00:06:351 - [INFO] 'SECURITY / LOGIN' Received from '' on

20210422 05:00:06:429 - [INFO] TEXT...
20210422 05:00:06:445 - [INFO] TEXT...
20210422 05:00:06:445 - [INFO] TEXT...
20210422 05:00:06:445 - [INFO] TEXT...
20210422 05:00:06:445 - [INFO] TEXT...

Sent XML Message:


Example of what the log looks like formatted on server


I am using the below to try and grab the whole log, which is not currently working.

multiline.pattern: '(?im)^Received XML Message:'
multiline.negate: true
multiline.match: after
multiline.flush_pattern: '(?im)^Sent XML Message:\r?\n<XML.*'

Any idea how i can manage to parse the full message please?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.