Mutiline pattern Filebeat

Elastic Stack Beats
1

Hello EveryOne,

I send data with filebeat and I want to use mutiline. Every event start with date like this :
2017-06-12T15:52:56.201_I_I_01de02a1ec3d0b28 [07:48] func will be continued(0,0000000001800094)

In logstash I used the following pattern : pattern => "^%{TIMESTAMP_ISO8601}" But with filebeat it doesn't work. I used also this pattern : '^[0-9]{4}-[0-9]{2}-[0-9]{2}' but it doesn't work also.

Thank you for your help !

2

filebeat version?

can you share your config and sample log lines?

This go-playground can be used to test multiline patterns. Just update the 'pattern', 'negate' and 'content' variable and click 'Run'.

3

The filebeat version is 5.4.0.

My config :
### Multiline options

  # Mutiline can be used for log messages spanning multiple lines. This is common
  # for Java Stack Traces or C-Line Continuation

  # The regexp Pattern that has to be matched. The example pattern matches all lines starting with [
  multiline.pattern: '^\[0-9]{4}-[0-9]{2}-[0-9]{2}' 
   #multiline.pattern: '^\['

  # Defines if the pattern set under pattern should be negated or not. Default is false.
  multiline.negate: true

  # Match can be set to "after" or "before". It is used to define if lines should be append to a pattern
  # that was (not) matched before or after or as long as a pattern is not matched based on negate.
  # Note: After is the equivalent to previous and before is the equivalent to to next in Logstash
  multiline.match: before

My log :

2017-06-12T15:52:56.201_I_I_01de02a1ec3d0b28 [09:05] >>>>>>>>>>>>resume interp(0), func:CallStrategy 
    _I_I_01de02a1ec3d0b28 [09:04] ASSIGN: iReturn(LOCAL) <- INTEGER: 0
    _I_I_01de02a1ec3d0b28 [09:04] ASSIGN: zVQGRP(LOCAL) <- STRING: "VQ_COFBE_OUTSOURCER_NL"
    _I_I_01de02a1ec3d0b28 [09:04] ASSIGN: iIteration(LOCAL) <- INTEGER: 2
    _I_I_01de02a1ec3d0b28 [09:04] ASSIGN: zTargetList(LOCAL) <- STRING: "COFBE_DEVELOPPEMENT_NL@StatServer_URS_COFBE.GA,COFBE_OUTSOURCER_NL@StatServer_URS_COFBE.GA"
    _I_I_01de02a1ec3d0b28 [09:04] ASSIGN: zTempo(LOCAL) <- STRING: "578"

2017-06-12T15:52:56.201 Int 22000 ##### EI_COFBE_SICRC04_GestionHO_SSTR-v8 - 01de02a1ec3d0b28 - Distribution : COFBE_070_NL_CIBLE :  distribution sur : COFBE_DEVELOPPEMENT_NL@StatServer_URS_COFBE.GA,COFBE_OUTSOURCER_NL@StatServer_URS_COFBE.GA - Iteration : 2
    _I_I_01de02a1ec3d0b28 [10:0d] HERE IS SDATA: VQ_90_078_COM_NL@COFBE_StatServer_CCA - StatLoadBalance
4

Someone could help ?

5

See go playground: https://play.golang.org/p/Q9AP0A6c5A

You regular expression seems invalid (well, still compiles), as you did escape the [ operator, such that is becomes a match on the [ character.

Try with multiline pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}'

6

It works Thank you !

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.