Newcomer multiline.pattern question

Hi, new to filebeat and multiline.pattern configuration as a whole.

I was reading up on multiline.pattern examples and came across this


where the example used was multiline.pattern: '[1]'. But lets say if each line after the initial line beginning was a symbol like { or " instead of a whitespace, how do I put it?
multiline.pattern: '^{' or multiline.pattern: '[2]' or something else entirely?

Sorry if it sounds like a dumb and simple question but I am not able to find any relevant/similar queries like this.


  1. [:space:] ↩︎

  2. [:{:] ↩︎

You should just do '^{'.

So if I want a combination of { and ", I should just do multiline.pattern '^{|^"' right?

Idk if that will work. I'd do ^({|")

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.