Optional <feff> on start of multiline pattern

Elastic Stack Logstash
1

< f e f f >[20170328,

I have log lines coming from an application that start normally with "[YYYYMMdd," which is easy to put into a multiline pattern, but occasionally there is a < f e f f > at the front of line.

I have tried

codec => multiline { pattern => "^[|^< f e f f >[" negate => true what => previous }

but to no avail. Is there a way to get this BOM to start a multiline pattern or even better a pattern that will allow it as an optional character?

Ignore the spaces in the eff e eff eff string as when I don't have them the editor translates it to a non-visible character.

thank you

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.