Multiple patterns in Multiline pattern not working

I am trying to capture specific lines using filebeat, but I'm unable to apply multiple patterns and get those lines into a single message.
zzz Thu Mar 22 17:49:46 UTC 2018
MemTotal: 24688032 kB
MemFree: 2628752 kB
MemAvailable: 15808568 kB
Buffers: 834784 kB
Cached: 11914956 kB
SwapCached: 0 kB
Active: 10500300 kB
Inactive: 10574108 kB
Active(anon): 6794112 kB
Inactive(anon): 1530748 kB
Active(file): 3706188 kB
Inactive(file): 9043360 kB
Unevictable: 0 kB
Mlocked: 0 kB
SwapTotal: 54521848 kB
SwapFree: 54521848 kB
Dirty: 372 kB
Writeback: 0 kB
AnonPages: 8324536 kB
Mapped: 178412 kB

I need to capture only lines containing 'MemTotal|MemFree|Buffers|Cached' and ignore other lines
I tried using
multiline.pattern with all options for negate & match. Still could not figure out.
Is there any way I can capture required info.?

You should use the include_lines option:

in this case:

 include_lines: ['^MemTotal:', '^MemFree:', '^Buffers:', '^Cached:']

But include_lines will provide info in 4 different messages. I need them in a single message.
Is it possible.?

Sorry I didn't realise you needed them in a single message.

For that you're going to resort to Logstash or an Ingest Pipeline in Elasticsearch

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.