Multiline is not fetching desired result from filebeat to ES

Elastic Stack Beats
1

I am not getting desired result .I have sample logs like below .I have multiline setting

multiline.pattern: '^[0-9]{4}'
multiline.negate: true
multiline.match: after

1.when i search for "2003787391047586" i want entire xml in output as 1 event
2.How to specify multiline pattern for date that has format "2020 Feb 11 06:56:30:554"

2020 Feb 11 06:56:30:554 GMT -0500 DEBUG [LogPool$0] com.ZU.digital.utilityservices.logging.Logging - EAI-DEBUG | ProcessOrderStatus.rule: Id - : OrderStatusNotification Payload : <?xml version="1.0" encoding="UTF-8"?>
<ns0:OSN >
ns0:merchantID200142</ns0:merchantID>
ns0:orderCode2003787391047586</ns0:orderCode>
ns0:lastEventCAPTURED</ns0:lastEvent>
ns0:paymentAmount12.90</ns0:paymentAmount>
ns0:paymentCurrencyEUR</ns0:paymentCurrency>
ns0:paymentCreditDebitINDC</ns0:paymentCreditDebitIND>
ns0:additionalData
ns0:data
ns0:name/
ns0:value/
</ns0:data>
</ns0:additionalData>
</ns0:OSN>
2020 Feb 11 06:56:30:554 GMT -0500 DEBUG [LogPool$0] com.ZU.digital.utilityservices.logging.Logging - Masking input XML in maskEntireXml

2

Can anyone please help here.

3

I tried with this expression
'^[0-9]{4}[[:space:]]'

it is giving desired result in go playground but not working in actual filebeat

4

Got resolved after making
negate to true

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.