Multiline grok problem

Elastic Stack Logstash
1

I am reading in the mysql slow log with a multiline filebeat, I would like to parse it in logstash. My log line looks like:

# Time: 160601 19:29:43
# User@Host: root[root] @ localhost []  Id: 1055005
# Schema:   Last_errno: 0  Killed: 0
# Query_time: 10.000128  Lock_time: 0.000000  Rows_sent: 1  Rows_examined: 0  Rows_affected: 0
# Bytes_sent: 64
SET timestamp=1464809383;
SELECT SLEEP(10);

And my match looks like

  match => { "message" => "# Time:%{GREEDYDATA:time_message} # User@Host: %{GREEDYDATA:mysql_user} @ %{GREEDYDATA:mysql_client} Id: %{GREEDYDATA:mysql_id} # Schema: %{GREEDYDATA:mysql_schema}  Last_errno: %{GREEDYDATA:mysql_errorno} Killed: %{GREEDYDATA:mysql_killed} # Query_time: %{GREEDYDATA:mysql_query_time}  Lock_time: %{GREEDYDATA:mysql_lock_time}  Rows_sent: %{GREEDYDATA:mysql_rows_sent}  Rows_examined: %{GREEDYDATA:mysql_rows_examined}  Rows_affected: %{GREEDYDATA:mysql_rows_affected} # Bytes_sent: %{GREEDYDATA:mysql_bytes_sent} SET timestamp=%{GREEDYDATA:mysql_timestamp}; %{GREEDYDATA:mysql_query}" }

Do I need to match the end of lines ? and if so how ?

For reference the multiline reading in filebeat is

  paths:
    - /home/galera/log/mysql-slow.log
  multiline:
    pattern: ^# Time
    negate: true
    match: after
    timeout: 5s
  input_type: log
  document_type: mysql-slow-log
2

I'd try \n or \s to match the newlines. They won't be removed by Filebeat so the string seen by the grok filter will be "# Time: 160601 19:29:43\n# User@Host: ...".

3

That is perfect thank you.