Multiline pattern in filebeat

Hi All,

what would be the multi-line pattern for

</ds:Reference>
</ds:SignedInfo>
ds:SignatureValue
attxcej7XBJ3rqWc9V0FbQwLLtBA7qvdNVmyErRANDUUrTpaxQCOaD8D4PpnVBaTCvana8RGLI1Q
AvHgqjaDk6qoBbS27Knznku+T02TbKXAi7TfD8+glAhTIt59VZ68dGlkDO3Aau6CMq0TGiGymSbq
2JjS8Sm4BjSAZDhgvZ087OVo8vHZqknXM05wvt4RRXhfxudmpliZmF1yhmQ13+oOX64gJb3lXnhF
eopGdJhWkWGVu4l6M7QXroTtJ6qaj9HiRoexUeCX2w7VWCRJH6H1YK6d/z89Cip7LDSle0Xy9+KG
lHmJXo0sC9WlyxysQu0nM7BK0Acny/giq3DuPg==
</ds:SignatureValue>
ds:KeyInfods:X509Datads:X509CertificateMIIDSzCCAjOgAwIBAgIUJ1fGLjazcb1hWl+0w+XJ2Gmk0LMwDQYJKoZIhvcNAQELBQAwIzEhMB8G
A1UEAwwYc3NvLmFuZG92ZXJjb21wYW5pZXMubmV0MB4XDTE3MTIwODIxMzAwMVoXDTM3MTIwODIx
MzAwMVowIzEhMB8GA1UEAwwYc3NvLmFuZG92ZXJjb21wYW5pZXMubmV0MIIBIjANBgkqhkiG9w0B
AQEFAAOCAQ8AMIIBCgKCAQEAwKiNvsXY4jVGC40xfJ3S98Mj4wmFYC93CkHKtGKE7ZfuFNoF4bxr
XnUt/ZMOVxJF/1Szf4WVpQRYogNHWzpTwTrhVkfG8V0HlXzwht1330rHo4ixo2iKGj6XY6KgBfJ0
ksOZ7oiCnQof+MDLA2PLyqeTKkPBV5dagN1/PwZoNhmveP6Qg9iWepvk0yAbzJRVSytHWnRtrCaq
TBL8Nwo6TGpDZOfSmr17qlZjtUY3h0F9g9rDDO5hzVLD7+8HVJX9Ct69RSg9EW3f6Ziqz3v9jf5r
w4ad0k5GYRfmAFzYcTj2U36xS9mJVCybC6nZo6bbg/+oaxOoUqx8wE/IEuEr6QIDAQABo3cwdTAd
BgNVHQ4EFgQUn0HrIIpZwjvh8V4bxxqybR4okjcwVAYDVR0RBE0wS4IYc3NvLmFuZG92ZXJjb21w
YW5pZXMubmV0hi9odHRwczovL3Nzby5hbmRvdmVyY29tcGFuaWVzLm5ldC9pZHAvc2hpYmJvbGV0
aDANBgkqhkiG9w0BAQsFAAOCAQEAYEorGjFzS46N2n3xs2b9goRTpZ7yHK46K6U/KiJcRq4k5LZd
otFe24OOYglFvQBTq9PIQJwk1Mxxzhm0OXZoGnWnhYl4yVQttg9YVKzV5r/Psx3RTFzq/T6zvZF+
WvdX1LLCpMThErlhdpqMPnAd1oG9SuUp1EfyF30lS/2VfLOkr32OOw6FYe+W00yorTxXu6aBcGEl
4ea0cLp6gECQZSnLZ/rLqlUIYVg6QZ3gkxvXhhcnG74CZBzdfOro3fpj/+fH6YLWht5DXqkDScsx

because it reads individual line as seperate index. How to get all the lines in one message field or accept all type of alphabets or symbols? Can I use (.|\n)* ?

Have you tried experimenting with the multiline options documented at https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html? What you have tried so far? What results did you get?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.