Please tell me why my filebeat multi-line pattern is not applicable

Elastic Stack Beats
1 
This is the harvester part of my file beat (version6.8)

I intend so that the multi-line pattern is applied if the beginning of the log is not an 8-digit number.

And if you encounter a log that starts with an 8-digit number, the multi-line pattern application ends.

''''
-type: log
enabled: true
paths:
- mylogpath
multiline.pattern: "^[^0-9]{8}"
multiline.negate: true
multiline.match: after
multiline.flush_pattern: "^[0-9]{8}"
''''

This is part of my log

20200604 101010101 log...\n
makdneislalwnrufoskqnrhdi \n
skckzjsnfjfozkwmrjfidis \n
skxkvignrndksoslqnrjfi \n
dkxovognrndjsisoakqmenrjdi \n
20200604 101010101 log... \n


I tried [[:digit]] instead of [0-9], but the result was the same.

But when I changed to \d, I couldn't try because of filebeat error.

Please help me what was wrong and what I missed Thank you

2

I don't think you need to configure multiline.flush_pattern. You should also change multiline.pattern.

The config above should work for your logs:

multiline.pattern: "^[0-9]{8}"
multiline.negate: true
multiline.match: after
3

Thank you very much for the answer,

but it seems to be a pattern that doesn't suit me.

What I want is to ignore the number log line starting with 8 digits, and I want to collect other things in a multi-line.

That's why you put flush.

Finally, I want to collect lines starting with 8 digits as a single line, and lines not starting with 8 digits as a multiline.

Can you help me ?