Hi, I've a strange problem with a multiline codec that doesn't work as i expect.
the same pattern work perfectly in a multiline filter.
i've logstash 2.1.0
the log begins with this date: 05/06/2016 17:31:15.690 CEST
the filter is: filter {
if [type] == "XXXXX" {
multiline {
pattern => "^[0-9][0-9]/[0-9][0-9]/[0-9]{4}\s[0-9][0-9]:[0-9][0-9]:[0-9][0-9].[0-9]{3}"
negate => true
what => "previous"
}
grok {
XXXXX
}
etc...
i've moved the same pattern in the inputs but it doesn't work.
input {
stdin {
codec => multiline {
pattern => "^[0-9][0-9]/[0-9][0-9]/[0-9]{4}\s[0-9][0-9]:[0-9][0-9]:[0-9][0-9].[0-9]{3}"
negate => "true"
what => "previous"
}
}
}
the codec with this pattern work: pattern => "^\s"
I've also tried to rewrite the pattern using grok patterns but also it doesn't work
Any suggest?
Alessandro