Multiline parsing error

[Muhammad_Faisal (abc123)]

hi all,

i am using multiline to parse below log format...1 log entry is separated by either line which appears as "!-----New----------" or "------------!" ..... i am using below regex ,although its segregating log entries but in the "message" field its also sending the regex pattern lines "!-----New----------" or "------------!" ...how to make sure multiline shall only send "key:value" in message field

          pattern => "(^!-+.*?-+)|(-+!)"
           negate => true
          what => "previous"
      }
grok {
        `match => { "message" => "%{GREEDYDATA:logs}"}
     
     }

!----- New ---------------------------------------------------------------
key : value
key : value
key : value
!----- Event ---------------------------------------------------------------
key : value
key : value
key : value
---------------------------------------------------------------------------!
!----- New ---------------------------------------------------------------
key : value
key : value
key : value
---------------------------------------------------------------------------!
!----- New ---------------------------------------------------------------

Output:

"message" => "!----- New ----------------------------------------\n Key:value

[Badger]

@Muhammad_Faisal

how to make sure multiline shall only send "key:value" in message field

That is not possible. The multiline codec combines the lines in a file, it does not modify them.

You can use mutate+gsub to remove text from the message field. For example

mutate { gsub => [ "message", "^!-+New-+", "" ] }