I have a log file. From this log file I need to separate the entries based on following pattern multiline.pattern: '^{"EntryDate'
multiline.negate: false
multiline.match: after
The output I am expecting is that Filebeat will separate the entries whenever it sees the line starting with {ËntryDate, but it does not do the same. It seems it does not honour the complete string and uses only the first character. In this case it is "{".
Sample File
{"EntryDate":"2019-06-21 20:42:06,777","correlationid":"(null)","level":"INFO ","Application":"VHQ NA","HostName":"blr2krishnas3","Component":"VHQDataService","customername": "(null)","username":"(null)","deviceuid":"(null)","deviceid":"(null)","serialnumber":"(null)","model":"(null)","classname":"System.Threading.Tasks.Task","method":"Execute","message":"Successfully executed."}
{"EntryDate":"2019-06-21 20:42:06,777","correlationid":"(null)","level":"DEBUG","Application":"VHQ NA","HostName":"blr2krishnas3","Component":"VHQDataService","customername": "(null)","username":"(null)","deviceuid":"(null)","deviceid":"(null)","serialnumber":"(null)","model":"(null)","classname":"System.Threading.Tasks.Task","method":"Execute","message":"Called."}
{"EntryDate":"2019-06-21 20:42:06,778","correlationid":"(null)","level":"DEBUG","Application":"VHQ NA","HostName":"blr2krishnas3","Component":"VHQDataService","customername": "(null)","username":"(null)","deviceuid":"(null)","deviceid":"(null)","serialnumber":"(null)","model":"(null)","classname":"System.Threading.Tasks.Task","method":"Execute","message":"IsPrivilegedUser called."}
{"EntryDate":"2019-06-21 20:42:06,778","correlationid":"(null)","level":"INFO ","Application":"VHQ NA","HostName":"blr2krishnas3","Component":"VHQDataService","customername": "(null)","username":"(null)","deviceuid":"(null)","deviceid":"(null)","serialnumber":"(null)","model":"(null)","classname":"System.Threading.Tasks.Task","method":"Execute","message":"PrivilegedUser called"}
{"EntryDate":"2019-06-21 20:42:06,769","correlationid":"(null)","level":"INFO ","Application":"VHQ NA","HostName":"blr2krishnas3","Component":"VHQDataService","customername": "(null)","username":"(null)","deviceuid":"(null)","deviceid":"(null)","serialnumber":"(null)","model":"(null)","classname":"System.Threading.Tasks.Task","method":"Execute","message":"TokenGuid : 9b607313-16a1-4d89-bc31-58ecc93f20d3 - UserName:sqm.syed096@gmail.com"}
{"EntryDate":"2019-06-21 20:42:06,778","correlationid":"(null)","level":"DEBUG","Application":"VHQ NA","HostName":"blr2krishnas3","Component":"VHQDataService","customername": "(null)","username":"(null)","deviceuid":"(null)","deviceid":"(null)","serialnumber":"(null)","model":"(null)","classname":"System.Threading.Tasks.Task","method":"Execute","message":"IsPrivilegedUser is successful."}
{"EntryDate":"2019-06-21 20:42:06,782","correlationid":"(null)","level":"INFO ","Application":"VHQ NA","HostName":"blr2krishnas3","Component":"VHQDataService","customername": "(null)","username":"(null)","deviceuid":"(null)","deviceid":"(null)","serialnumber":"(null)","model":"(null)","classname":"System.Threading.Tasks.Task","method":"Execute","message":"Successfully opened the database connection"}
{"EntryDate":"2019-06-21 20:42:06,769","correlationid":"(null)","level":"INFO ","Application":"VHQ NA","HostName":"blr2krishnas3","Component":"VHQDataService","customername": "(null)","username":"(null)","deviceuid":"(null)","deviceid":"(null)","serialnumber":"(null)","model":"(null)","classname":"System.Threading.Tasks.Task","method":"Execute","message":"GetTokenDetails call over "}
{"EntryDate":"2019-06-21 20:42:07,733","correlationid":"(null)","level":"DEBUG","Application":"VHQ NA","HostName":"blr2krishnas3","Component":"VHQDataService","customername": "(null)","username":"(null)","deviceuid":"(null)","deviceid":"(null)","serialnumber":"(null)","model":"(null)","classname":"System.Threading.Tasks.Task","method":"Execute","message":"correlationState for operationName GetLogs are as follows {}"}
{"EntryDate":"2019-06-21 20:42:07,725","correlationid":"(null)","level":"DEBUG","Application":"VHQ NA","HostName":"blr2krishnas3","Component":"VHQDataService","customername": "(null)","username":"(null)","deviceuid":"(null)","deviceid":"(null)","serialnumber":"(null)","model":"(null)","classname":"System.Threading.Tasks.Task","method":"Execute","message":"outputs for operationName GetLogs are as follows { "StatusCode": 1, "StatusMessage": "Success", "AdditionalInfo": null}"}
{"EntryDate":"2019-06-21 20:42:07,725","correlationid":"(null)","level":"DEBUG","Application":"VHQ NA","HostName":"blr2krishnas3","Component":"VHQDataService","customername": "(null)","username":"(null)","deviceuid":"(null)","deviceid":"(null)","serialnumber":"(null)","model":"(null)","classname":"System.Threading.Tasks.Task","method":"Execute","message":"outputs for operationName GetLogs are as follows "{\"Logs\":,\"PaginationResponse\":{\"TotalPages\":0,\"TotalRecords\":0}}""}
{"EntryDate":"2019-06-21 20:42:08,058","correlationid":"(null)","level":"DEBUG","Application":"VHQ NA","HostName":"blr2krishnas3","Component":"VHQDataService","customername": "(null)","username":"(null)","deviceuid":"(null)","deviceid":"(null)","serialnumber":"(null)","model":"(null)","classname":"System.Threading.Tasks.Task","method":"Execute","message":"Parameters passed for operationName GetLogs are as follows {}"}
{"EntryDate":"2019-06-21 20:42:08,059","correlationid":"(null)","level":"DEBUG","Application":"VHQ NA","HostName":"blr2krishnas3","Component":"VHQDataService","customername": "(null)","username":"(null)","deviceuid":"(null)","deviceid":"(null)","serialnumber":"(null)","model":"(null)","classname":"System.Threading.Tasks.Task","method":"Execute","message":"Parameters passed for operationName GetLogs are as follows { "ColumnSortFilter": { "SortList": null, "FilterList": [ { "FilterColumn": "Level", "FilterValue": "ERROR", "ColumnType": null, "FilterValueOptional": null, "FilterTableColumn": null, "FilterDays": 0, "IsFixedDateRange": false }, { "FilterColumn": "Component", "FilterValue": "Device", "ColumnType": null, "FilterValueOptional": null, "FilterTableColumn": null, "FilterDays": 0, "IsFixedDateRange": false }, { "FilterColumn": "EntryDate", "FilterValue": "2018-06-05 09:15:00", "ColumnType": null, "FilterValueOptional": "2019-06-21 08:18:00", "FilterTableColumn": null, "FilterDays": 0, "IsFixedDateRange": false } ], "GridId": "Logs" }, "Pagination": { "PageNumber": 1, "RowsPerPage": 50, "HighLightedItemId": null }}"}
Record which got inserted in Elasticsearch
