Multiline match pattern but don't send it

Elastic Stack Beats
1

Windows filebeat 6.2.3

My multiline pattern works great, and want to know if I can also filter out sending those patterns?

  multiline.pattern: '^[-]{6,}[ ]Event Log Start Here[ ][-]{6,}'
  multiline.negate: true
  multiline.match: after
  multiline.flush_pattern: '^[-]{6,}[ ]Event Log End Here[ ][-]{6,}'

This successfully processes the following entiry:

--------------- Event Log Start Here ---------------
EventId : 3, Level : Warning, Message : Some normal message that gets logged. Timestamp : 2018-03-22T19:29:52.7154207Z
--------------- Event Log End Here ---------------

Now, how can I have this not send the first and last lines, meaning, only send this:

EventId : 3, Level : Warning, Message : Some normal message that gets logged. Timestamp : 2018-03-22T19:29:52.7154207Z
2

I think that's not possible, you may need to use Logstash to filter these using a pipeline

3

Thank, I was just logging on to write the same thing. Logstash, here I come!@

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.