Multiline breaking in blank line

Elastic Stack Beats
1

This has been reports a few times but I can not put the answer together.
I would like these lines to arrive as one multiline. But they arrive as 5 lines. Which is odd because the pattern clearly only matches the first line.

Ref:
Filebeat 1.1.1: empty line is always treated as multiline events separator · Issue #1040 · elastic/beats · GitHub
Filebeat not sending empty lines - Elastic Stack / Beats - Discuss the Elastic Stack
Multiline and blank lines - Elastic Stack / Beats - Discuss the Elastic Stack

  multiline.type: pattern
  multiline.pattern: '^\d{2}:\d{2}:\d{2}.\d{3}'
  multiline.negate: true
  multiline.match: after

19:00:22.167 Trc 04541 Message 

  MSGCFG
  attr:   
  attr:
  attr:
2

Odd;

As soon as I did this post it works.

I tested this pattern:

multiline.pattern: '^\d{2}:\d{2}:\d{2}.\d{3}|$'

no good

Switched it back to

 multiline.pattern: '^\d{2}:\d{2}:\d{2}.\d{3}'

add it worked.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.