Multiline containing xml , Not working

Elastic Stack Beats
1

I am trying to parse xml logs which are in multiline format. The pattern works fine when I checked on The Go Playground , but not working when I actually start filebeat.

Input log:

2018-12-31 08:49:42,529 DEBUG AAA 2bfba8b1-9dbb-30a1-a49b-18f05bbec18d 3e52f114-d830-ef82-0734-132e39777d7f AO abcOM1 AO1836500704 GetUsersforActivtyWrapper FLOWLOG Post
2018-12-31 08:49:43,302 DEBUG AAA 2bfba8b1-9dbb-30a1-a49b-18f05bbec18d 3e52f114-d830-ef82-0734-132e39777d7f AO abcOM1 AO1836500704 ParseUMResponse FLOWLOG Post
















2018-12-31 08:49:42,529 DEBUG AAA 2bfba8b1-9dbb-30a1-a49b-18f05bbec18d 3e52f114-d830-ef82-0734-132e39777d7f AO abcOM1 AO1836500704 GetUsersforActivtyWrapper FLOWLOG Post

Pattern:
multiline.pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2},[0-9]{3}'
multiline.negate: true
multiline.match: after

Output in Kibana:
xml line is coming as an individual input.

PFA

2

Hi @Ani :slight_smile:

I'll try to configure Filebeat using console as output, to detect if it's an issue with the parsing, it doesn't reach Elasticsearch or if it's a Kibana issue.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.