Multiline match wrong

Elastic Stack Logstash
1

log file

---------------------------------------------------------------
[ 2019-08-14T09:16:11+08:00 ] 127.0.0.1 GET localhost:8000/
[ error ] xxx
[ error ] xxxxx
[ error ] xxxxx

---------------------------------------------------------------
[ 2019-08-14T09:16:11+08:00 ] 127.0.0.1 GET localhost:8000/
[ error ] xxx
[ error ] xxxxx
[ error ] xxxxx

---------------------------------------------------------------
[ 2019-08-14T09:16:11+08:00 ] 127.0.0.1 GET localhost:8000/
[ error ] xxx
[ error ] xxxxx
[ error ] xxxxx

---------------------------------------------------------------
[ 2019-08-14T09:16:11+08:00 ] 127.0.0.1 GET localhost:8000/
[ error ] xxx
[ error ] xxxxx
[ error ] xxxxx

filter {
    multiline {
        what => previous
        negate => true
        pattern => "/^---------------------------------------------------------------\r\n$/g"
    }
}

got:

![](https://cdck-file-uploads-us1.s3.dualstack.us-west-2.amazonaws.com/elastic/original/3X/c/c/ccace88e25967944c19b1291059705e44535fac3.png)

just only one message :(..

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.