Not able to get multiline pattern properly for my log message

Elastic Stack Beats
1

Hello,

Below is my log msg where i need to split multiline with "[gc ]" text. Tried some options which doesn't work. Pls let me know the issue


[2024-10-16T00:52:58.870+0000][0.013s][gc     ] Using G1
[2024-10-16T00:53:05.153+0000][6.296s][gc,heap] GC(0) Heap before GC invocations=0 (full 0):
[2024-10-16T00:52:58.870+0000][0.013s][gc     ] Using G1
[2024-10-16T00:53:05.153+0000][6.296s][gc,heap] GC(0) Heap before GC invocations=0 (full 0):
[2024-10-16T00:52:58.870+0000][0.013s][gc     ] Using G1
[2024-10-16T00:53:05.153+0000][6.296s][gc,heap] GC(0) Heap before GC invocations=0 (full 0):

Tried as below which didn't work


 multiline.pattern: '\[gc(.)*?'
2

H @Bhanu_Praveen, Are you using logstash to parse the same?

3

Filebeats as tagged..

filebeat.inputs:
- type: log
  enabled: true
  paths:
    - "/opt/micro_service/TA/MOUNT/gc_logs/s1gc3.log"
  multiline.pattern: '\[gc(.)*?'
  multiline.negate: true
  multiline.match: before
  max_bytes: 10485760
  fields:
    index: hc-gc
    hc_type: gc-log