Multiline for Logline starting with "STATUS" or "INFO"

Elastic Stack Beats
1

I have some logs whose one word starts with "STATUS" or "INFO" and in my multline pattern, I want to identify these words as starting point. WHat will be the multiline? I tried

multiline.pattern: '^%{WORD}'

Sample Logs are below -

STATUS | wrapper  | 2019/12/03 05:18:27 | --> Wrapper Started as Service 
INFO   | jvm 832  | 2020/02/25 09:00:04 | 	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[na:1.8.0_181]
INFO   | jvm 2    | 2020/03/25 12:36:32 | 2020-03-25 12:36:32,291 INFO  [WrapperSimpleAppMain] o.s.web.context.ContextLoader - Root WebApplicationContext: initialization started

I saw that in some examples when log doesnt start from date or timestamp, we can give a customized pattern like this-

multiline:
        pattern: 'wordwewanttostartsentencefrom: Identifier$'
        negate:  true
        match:   after
2

@steffens I read alot of your comments based on this topic. But none were where log line didnt start from timestamp. So could you please suggest.

@andrewkroh I also read your comment on post bellow and tried the method suggested there by replacing multiline.pattern: 'STATUS: Identifier$' but taht didnt work either. Please suggest multiline pattern for above log sample.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.