Multline in filebeat

Elastic Stack Beats
1

HI,
I'm just trying to split events from my log by using of multline concept. I have given my pattern to split the events but is failed to split and capturing entire data into single event in elasticsearch. Please find my pattern and input,

multiline:
pattern: "\d{4}-\d{2}"
negate: true
match: before

2016-08-03 16:17:04,350 [171] [hi
]
2016-08-03 16:17:04,350 [171] [hi
]
2016-08-03 16:17:04,350 [171] [hi
]

2

Try this:

    multiline:
      pattern: '\d{4}-\d{2}'
      negate:  true
      match:   after
3

This topic was automatically closed after 21 days. New replies are no longer allowed.